Cybersecurity Roundup Covers Lazarus, Star Blizzard and Treasury Attacks
Summary
A February roundup summarizes reports on Lazarus’s CookiePlus campaign, Star Blizzard phishing, a Treasury intrusion attributed to Silk Typhoon, malware activity and law-enforcement actions involving crypto mixers and LockBit.
Key points
- Lazarus reportedly targeted at least two employees at an unnamed nuclear-related organization in January 2024 with the CookiePlus backdoor, as part of Operation Dream Job.
- Microsoft reported that Star Blizzard used emails impersonating U.S. officials to target people in government, diplomacy, defense policy and related fields, then sent a malicious link after recipients replied.
- Silk Typhoon was linked to breaches of several U.S. Treasury offices through a BeyondTrust remote management service; the impact on the Office of Financial Research was still being assessed.
- The U.S. Department of Justice charged Rostislav Panev over his suspected role as a LockBit developer; he was arrested in Israel and was awaiting extradition.
- The roundup reports that Kaspersky identified BellaCPP, a new C++ variant of the BellaCiao malware used by the Iranian threat actor Charming Kitten.
- The DOJ announced indictments of three Russian nationals for operating cryptocurrency mixing services Blender.io and Sinbad.io; two were arrested and one remained at large.
Article Details
- Event Type
- Weekly threat intelligence news roundup covering cyber espionage, phishing, ransomware, cryptocurrency mixing services, sanctions, and law enforcement actions.
- Impact
- Reported incidents include Lazarus Group targeting employees at an unnamed nuclear-related organization with CookiePlus, Star Blizzard phishing high-value diplomats and related targets through an email-to-WhatsApp lure, Silk Typhoon breaching U.S. Treasury offices through a BeyondTrust remote management service, and Charming Kitten using BellaCPP. The roundup also reports arrests, indictments, a ransomware operation disruption, and a presidential pardon. The impact of the Office of Financial Research breach was still being assessed.
People
Alexander Evgenievich OleynikOne of three Russian nationals indicted for operating cryptocurrency mixing services; arrested in December 2024.Anton Vyachlavovich TarasovOne of three Russian nationals indicted for operating cryptocurrency mixing services; reported to be at large.Donald TrumpU.S. President who pardoned Ross Ulbricht on January 21.Roman Vitalyevich OstapenkoOne of three Russian nationals indicted for operating cryptocurrency mixing services; arrested in December 2024.Ross UlbrichtFounder and operator of Silk Road; pardoned by President Donald Trump on January 21.Rostislav PanevCharged as a suspected developer for the LockBit ransomware group; arrested in Israel in August and awaiting extradition.
Threat Actors
Charming KittenIranian threat actor reported to have used a new C++ variant of BellaCiao malware.Lazarus GroupNorth Korean state-backed cyber threat actor reported to have targeted employees at an unnamed nuclear-related organization.LockBitRansomware-as-a-service operation whose suspected developer was charged; disrupted in February 2024 by an international law enforcement operation.Silk TyphoonChinese state-backed threat actor linked to attacks on U.S. Department of the Treasury offices.Star BlizzardRussian threat actor reported to have orchestrated a spear-phishing campaign targeting people in government, diplomacy, defense policy, international relations, and Ukraine aid organizations.
Malware
BellaCiao8. Iran’s Charming Kitten Deploys BellaCPP: A New C++ Variant of BellaCiao Malware – The Hacker NewsBellaCPP8. Iran’s Charming Kitten Deploys BellaCPP: A New C++ Variant of BellaCiao Malware – The Hacker NewsCookiePlusin January 2024 and, according to BleepingComputer, involved the deployment of a new backdoor dubbed “CookiePlus.” The attacks were part of the ongoing cyber espionage campaign “Operation Dream Job.” Read full
Vendors
BeyondTrustHackers gained access by breaching a BeyondTrust remote management service.KasperskyThe cybersecurity firm Kaspersky has dubbed the new C++ variant “BellaCPP.“ BellaCiao malware was first observed in 2023 and has since been used in cyber attacks against organizations in the U.S., India, and the MiddleMicrosoftIn a January 16 report, Microsoft Threat Intelligence detailed a new phishing campaign orchestrated by the Russian threat actor Star Blizzard.
Products
Blender.ioDepartment of Justice announced the indictment of three Russian nationals for their role in operating the cryptocurrency mixing services Blender.io and Sinbad.io.Silk Road4. President Trump Pardons Silk Road Creator Ross Ulbricht After 11 Years in Prison – The Hacker NewsSinbad.ioDepartment of Justice announced the indictment of three Russian nationals for their role in operating the cryptocurrency mixing services Blender.io and Sinbad.io.WhatsApp5. Star Blizzard hackers abuse WhatsApp to target high-value diplomats – Bleeping Computer
Countries
Iran8. Iran’s Charming Kitten Deploys BellaCPP: A New C++ Variant of BellaCiao Malware – The Hacker NewsIsraelPanev was arrested in Israel in August where he is currently awaiting extradition.Ukraine2024 and targeted individuals in “government, diplomacy, defense policy, international relations, and Ukraine aid organizations.” The newly observed spear-phishing campaign functioned by sending emails impersonating
Industries
GovernmentAccording to the report, the campaign occurred in November 2024 and targeted individuals in “government, diplomacy, defense policy, international relations, and Ukraine aid organizations.” The newly observednuclearThe Lazarus Group, a North Korean state-backed cyber threat actor, was found to have targeted at least two employees at an unnamed “nuclear-related” organization.