July Cybersecurity Roundup: Ransomware Actions, Malware Campaigns and Arrests
Summary
A July roundup covers arrests and seizures, Android banking malware on Google Play, campaigns targeting Tibet, Interlock ransomware warnings, and U.S. sanctions over North Korean IT worker schemes.
Key points
- French authorities announced the arrest in Ukraine of the alleged administrator of the XSS cybercrime forum; authorities also seized the XSS[.]is domain.
- ThreatFabric researchers reported that an Anatsa banking-malware app posing as a PDF viewer was downloaded more than 50,000 times from the U.S. Google Play Store before removal.
- Morphisec researchers reported the return of Pay2Key ransomware as a service, with an 80% profit share for affiliates supporting Iran or attacking its adversaries.
- Zscaler ThreatLabz attributed two campaigns targeting the Tibetan community to a China-linked APT group; the campaigns used Ghost RAT and PhantomNet backdoors.
- The FBI, CISA, HHS and MS-ISAC warned that Interlock ransomware has targeted business and critical-infrastructure sectors in North America and Europe.
- The FBI seized cryptocurrency allegedly associated with a Chaos ransomware group member; the roundup also reports four arrests in connection with attacks on UK retailers.
- The U.S. Treasury sanctioned a North Korean firm and three individuals over fraudulent remote IT worker schemes involving stolen identities and false personas.
Article Details
- Event Type
- Cybersecurity threat-intelligence roundup covering law-enforcement actions, malware campaigns, ransomware activity, cyberattacks, and sanctions.
- Impact
- Authorities arrested suspected cybercrime-forum administrators and ransomware affiliates, seized domains and cryptocurrency, and sanctioned individuals and a company linked to fraudulent IT-worker schemes. Reported threats included Anatsa targeting North American banking-app users, Pay2Key.I2P ransomware activity, campaigns targeting the Tibetan community, Interlock attacks against business and critical-infrastructure sectors, and attacks on retailers.
Threat Actors
Malware
Anatsa2. Android malware Anatsa infiltrates Google Play to target US banks – Bleeping ComputerChaos6. FBI seizes $2.4M in Bitcoin from new Chaos ransomware operation – Bleeping ComputerGhost RATThe two campaigns—dubbed Operation GhostChat and Operation PhantomPrayers—targeted Tibet with multi-stage infection chains deploying Ghost RAT and PhantomNet backdoors.Interlock5. CISA and FBI warn of escalating Interlock ransomware attacks – Bleeping ComputerPay2Key3. Iranian-Backed Pay2Key Ransomware Resurfaces with 80% Profit Share for Cybercriminals – The Hacker NewsPhantomNetThe two campaigns—dubbed Operation GhostChat and Operation PhantomPrayers—targeted Tibet with multi-stage infection chains deploying Ghost RAT and PhantomNet backdoors.
Products
Countries
China4. China-Based APTs Deploy Fake Dalai Lama Apps to Spy on Tibetan Community – The Hacker NewsIran(RaaS) “Pay2Key.” The company’s report—released just a month after Israel launched attacks against Iran’s nuclear and military facilities—reveals that the scheme now operates as “Pay2Key.I2P” and offers aIsraelIranian-backed ransomware-as-a-service (RaaS) “Pay2Key.” The company’s report—released just a month after Israel launched attacks against Iran’s nuclear and military facilities—reveals that the scheme now operates asNorth KoreaDepartment of the Treasury’s Office of Foreign Assets Control (OFAC) announced the sanctioning of the North Korea-based Korea Sobaeksu Trading Company and three associated individuals for their participation inUkraine1. Ukraine arrests suspected admin of XSS Russian hacking forum – Bleeping Computer