Weekly Threat Intelligence Roundup: Hosting Takedown, Spyware Campaign and Cyberattacks
Summary
The roundup covers a Dutch server seizure linked to Zservers/XHost, cyber-espionage and spyware campaigns, EU sanctions and an arrest, and a joint advisory on Ghost ransomware activity across more than 70 countries.
Key points
- Dutch police seized 127 servers associated with Zservers/XHost after sanctions were announced; the provider was described as supporting ransomware operations, including LockBit.
- Sandworm reportedly used trojanized Windows activators, fake updates and DarkCrystal RAT to target users in Ukraine and collect sensitive information.
- Meta said nearly 100 WhatsApp users, mostly journalists and civil-society members, were targeted in a spyware campaign involving Paragon Solutions; users may have been compromised.
- Researchers linked the RevivalStone cyber-espionage campaign, targeting Japanese manufacturing, materials and energy companies, to Winnti/APT41.
- The EU sanctioned three GRU officers over cyberattacks on Estonian government ministries in 2020 that reportedly involved theft of confidential documents.
- Spanish authorities arrested a suspected 18-year-old hacker accused of more than 40 attacks against Spanish and international organizations.
- CISA, the FBI and MS-ISAC issued an advisory on Ghost ransomware, reporting that associated actors had targeted organizations in more than 70 countries since 2021.
Article Details
- Event Type
- Cybersecurity threat-intelligence roundup covering law-enforcement action, sanctions, spyware and ransomware campaigns, cyberespionage, and arrests.
- Impact
- Reported impacts include the seizure of 127 servers associated with Zservers/XHost; attacks targeting users and organizations in multiple countries; nearly 100 WhatsApp users targeted and possibly compromised; theft of confidential Estonian government documents; and alleged access to personal information and internal documents by a suspected hacker. Ghost ransomware activity reportedly affected organizations in more than 70 countries.
MITRE ATT&CK
T1059.001 · PowerShellKimusky reportedly tricked targets into running code in PowerShell as an administrator.T1204 · User ExecutionKimusky reportedly persuaded targets to paste and run code supplied by the threat actor.T1566 · PhishingKimusky reportedly sent a spear-phishing email after building rapport with the target.
People
NatohubPseudonym of the 18-year-old suspected hacker arrested in Spain; authorities allege he conducted more than 40 cyberattacks.Nikolay KorchaginOne of three GRU officers sanctioned by the European Union for their role in cyberattacks against Estonia's government in 2020.Vitaly ShevchenkoOne of three GRU officers sanctioned by the European Union for their role in cyberattacks against Estonia's government in 2020.Yuriy DenisovOne of three GRU officers sanctioned by the European Union for their role in cyberattacks against Estonia's government in 2020.
Threat Actors
KimuskyGroup observed using a rapport-building and spear-phishing approach to trick targets into running PowerShell code; also known as Velvet Chollima and Emerald Sleet.SandwormGroup observed deploying trojanized Windows activators, fake updates, and DarkCrystal RAT in attacks targeting users in Ukraine; also known as Seashell Blizzard.SPIRE CASTLEName used for Winnti, which was linked to the RevivalStone cyberespionage campaign targeting Japanese companies.Winnti GroupGroup linked to the RevivalStone cyberespionage campaign targeting Japanese companies; also known as APT41.
Malware
BACKORDERKey Management Service (KMS) activators, fake Windows updates, and DarkCrystal RAT malware via a BACKORDER loader.DarkCrystal RATdeployed trojanized Microsoft Key Management Service (KMS) activators, fake Windows updates, and DarkCrystal RAT malware via a BACKORDER loader.Ghost8. CISA and FBI: Ghost ransomware breached orgs in 70 countries – Bleeping ComputerGhost (Cring) Ransomwareindicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with Ghost (Cring) Ransomware.
Vendors
Products
Tools
Countries
Estonia5. E.U. Sanctions Three GRU Officers For Cyberattacks Against Estonia – The Hacker NewsRussiaAs noted in the U.K.’s press release, the Russia-based bulletproof hosting (BPH) services provider was a “key component of the Russian cybercrime supply chain” and was responsible for “facilitating crippling ransomwareSpain6. Spain arrests suspected hacker of US and Spanish military agencies – Bleeping ComputerUkraine2. Russian military hackers deploy malicious Windows activators in Ukraine – Bleeping Computer
Industries
Critical infrastructureVictims have included organizations in a variety of sectors, including critical infrastructure, education, and healthcare.EducationVictims have included organizations in a variety of sectors, including critical infrastructure, education, and healthcare.EnergyThe campaign took place in March 2024 and specifically targeted companies in the manufacturing, materials, and energy sectors.HealthcareVictims have included organizations in a variety of sectors, including critical infrastructure, education, and healthcare.ManufacturingThe campaign took place in March 2024 and specifically targeted companies in the manufacturing, materials, and energy sectors.MaterialsThe campaign took place in March 2024 and specifically targeted companies in the manufacturing, materials, and energy sectors.