cyber.hendryadrian.com
Security News · securityweek.com

Proofpoint Links Star Blizzard to DarkSword iOS Exploit Kit Campaign

· Original article ↗

Summary

Proofpoint says Star Blizzard used DarkSword in an email campaign targeting multiple sectors. It cites loader and URLScan evidence but has not observed the exploit kit’s delivery; its use for credential harvesting and intelligence collection is an assessment.

Key points

  • Proofpoint attributes the campaign to Star Blizzard, also tracked as TA446, Callisto, ColdRiver and SeaBorgium.
  • The March 26 emails came from multiple compromised sender addresses and used links rather than malicious attachments.
  • Proofpoint reported a sharp increase in the group’s malicious email volume compared with its usual activity.
  • Evidence cited includes a DarkSword loader uploaded to VirusTotal and a URLScan submission showing the exploit’s use.
  • The observed kit components included a redirector, exploit loader, RCE and PAC bypass; sandbox escapes were not observed.
  • Targets included financial, government, higher-education and legal entities, as well as think tanks. Proofpoint has not observed the kit’s delivery and believes it may be used for credential harvesting and intelligence collection.

Article Details

Event Type
Reported phishing campaign in which Star Blizzard adopted the DarkSword iOS exploit kit.
Impact
The campaign targeted financial, government, higher education, legal, and think-tank entities. Proofpoint believes the capability may be used for credential harvesting and intelligence collection, but says it has not observed delivery of the exploit kit.

MITRE ATT&CK

T1566.002 · Spearphishing LinkThe reported campaign used emails containing links to deliver or direct recipients toward malicious content.

Threat Actors

COLD RELICThe article identifies ColdRiver as another name used for Star Blizzard, which Proofpoint attributed with the reported campaign.Star BlizzardProofpoint attributed the reported campaign and use of the DarkSword iOS exploit kit to Star Blizzard.

Malware

GHOSTBLADEOn Friday, investigation platform Malfors warned that a Russian threat actor has been using Atlantic Council lures in an email campaign delivering the DarkSword-linked GhostBlade malware.

Vendors

Appleits arsenal, pointing out that this is the first time the APT has been seen targeting iCloud accounts and Apple devices.

Products

iCloudiOS exploit kit to its arsenal, pointing out that this is the first time the APT has been seen targeting iCloud accounts and Apple devices.iOSA Russian state-sponsored hacking group tracked as Star Blizzard has adopted the DarkSword iOS exploit kit in an ongoing campaign, Proofpoint reports.

Tools

DarkSwordA Russian state-sponsored hacking group tracked as Star Blizzard has adopted the DarkSword iOS exploit kit in an ongoing campaign, Proofpoint reports.

Countries

RussiaRelated: Ex-US Defense Contractor Executive Jailed for Selling Exploits to Russia

Industries

financialThe Atlantic Council-themed campaign has targeted financial, government, higher education, and legal entities, as well as think tanks, “indicating that this new capability led TA446 to attempt to use DarkSwordGovernmentThe Atlantic Council-themed campaign has targeted financial, government, higher education, and legal entities, as well as think tanks, “indicating that this new capability led TA446 to attempt to use DarkSwordHigher EducationThe Atlantic Council-themed campaign has targeted financial, government, higher education, and legal entities, as well as think tanks, “indicating that this new capability led TA446 to attempt to use DarkSwordLegalThe Atlantic Council-themed campaign has targeted financial, government, higher education, and legal entities, as well as think tanks, “indicating that this new capability led TA446 to attempt to use DarkSwordThink tankscampaign has targeted financial, government, higher education, and legal entities, as well as think tanks, “indicating that this new capability led TA446 to attempt to use DarkSword opportunistically against a

Related Articles