August Threat Intelligence Roundup Covers Ransomware Tools, Malware Campaigns and Cybercrime Cases
Summary
DarkOwl’s roundup highlights recent cybercrime extraditions and sanctions, a new EDR-killing tool reportedly used by eight ransomware groups, and campaigns involving spyware, espionage backdoors and phishing-delivered malware.
Key points
- Four Ghanaian nationals were extradited to the U.S. over alleged participation in romance-scam and business-email-compromise operations that prosecutors say stole more than $100 million.
- Eight ransomware groups were reportedly observed using a new tool that disables endpoint detection and response products.
- CTM360 researchers described the FraudOnTok campaign, which uses fake TikTok shopping sites and SparkKitty spyware to target users and steal cryptocurrency wallets.
- SEQRITE Labs reported Operation CargoTalon, an espionage campaign targeting Russian aerospace and defense employees with the EAGLET backdoor.
- ReliaQuest observed tactics in ShinyHunters attacks on Salesforce customers that it said suggest possible collaboration with Scattered Spider.
- CERT-UA warned that UAC-0099 used phishing emails disguised as court summons to deliver MATCHBOIL, MATCHWOK and DRAGSTARE malware to Ukrainian organizations.
- The U.S. Treasury sanctioned a North Korean company and three individuals over fraudulent remote IT-worker schemes involving stolen identities and false personas.
Article Details
- Event Type
- Threat intelligence roundup covering cybercrime, ransomware, phishing, malware, cyberespionage, extortion, and fraudulent IT worker schemes.
- Impact
- Reported activity includes theft and fraud, cryptocurrency wallet theft, data exfiltration, attacks on organizations and government entities, and efforts to disable endpoint security. The article also reports extraditions and sanctions related to alleged cybercrime and fraudulent IT worker schemes.
Threat Actors
BlacksuitListed among ransomware groups observed using a new EDR killer.DragonForceListed among ransomware groups observed using a new EDR killer.MedusaListed among ransomware groups observed using a new EDR killer.QilinListed among ransomware groups observed using a new EDR killer.RansomHubRansomware group reported to have developed the EDRKillShifter tool; listed among groups observed using a newer EDR killer.
Malware
DRAGSTAREcomplex of Ukraine.” As noted in the statement, the threat actor delivers MATCHBOIL, MATCHWOK, and DRAGSTARE malware via phishing emails.EAGLET4. Cyber Espionage Campaign Hits Russian Aerospace Sector Using EAGLET Backdoor – The Hacker NewsEDRKillShifterAccording to BleepingComputer, eight different ransomware groups have been observed using a new endpoint detection and response (EDR) killer believed to be an evolution of the “EDRKillShifter” developed by RansomHub.MatchBoilof the defense-industrial complex of Ukraine.” As noted in the statement, the threat actor delivers MATCHBOIL, MATCHWOK, and DRAGSTARE malware via phishing emails.MatchWokdefense-industrial complex of Ukraine.” As noted in the statement, the threat actor delivers MATCHBOIL, MATCHWOK, and DRAGSTARE malware via phishing emails.SparkKittyResearchers at CTM360 have identified a new malware campaign dubbed “FraudOnTok” that targets users through fake TikTok Shops with SparkKitty spyware.
Vendors
CTM3603. CTM360 spots Malicious ‘FraudOnTok’ Campaign Targeting TikTok Shop users – Bleeping ComputerReliaQuestResearchers at ReliaQuest have observed a shift in tactics used by the hacking group ShinyHunters that suggests possible collaboration with the Scattered Spider group.SEQRITE LabsResearchers at SEQRITE Labs have observed a cyberespionage campaign targeting Russian aerospace and defense industries.
Products
SalesforceFollowing a year of limited activity, ShinyHunters’ campaigns resurged this summer with a series of attacks against Salesforce customers.TikTok MallThe threat actors utilize replicas of TikTok Shop, TikTok Wholesale, and TikTok Mall to deceive users into believing they’re using the genuine platforms before stealing cryptocurrency wallets.TikTok Shop3. CTM360 spots Malicious ‘FraudOnTok’ Campaign Targeting TikTok Shop users – Bleeping ComputerTikTok WholesaleThe threat actors utilize replicas of TikTok Shop, TikTok Wholesale, and TikTok Mall to deceive users into believing they’re using the genuine platforms before stealing cryptocurrency wallets.
Tools
Countries
Francefrom France “in connection with hacking, fraud, and identity theft offenses.” According to the statement, the subject participated in multiple fraud schemes, including one targeting U.S.GhanaThe defendants were extradited from Ghana and arrived in the U.S.NigeriaThe scheme involved other Nigeria-based co-conspirators who used spear phishing emails to hack “several U.S.North KoreaDepartment of the Treasury’s Office of Foreign Assets Control (OFAC) announced the sanctioning of the North Korea-based Korea Sobaeksu Trading Company and three associated individuals for their participation inRussiaAccording to the company’s report, the campaign has specifically targeted employees at Voronezh Aircraft Production Association (VASO), one of Russia’s largest aircraft production entities.UkraineIn an August 4 press release, Ukraine’s Computer Emergency Response Team (CERT-UA) warned of a series of cyber attacks carried out by the threat actor UAC-0099 against “state authorities, the Defense Forces, andUnited StatesIn an August 8 press release, the United States Attorney’s Office for the Southern District of New York announced the extradition of four Ghanaian nationals for participating in an international criminal organization