November Threat Intelligence Roundup Highlights Malware, Espionage and Law Enforcement
Summary
A curated roundup covers espionage and malware campaigns, phishing using SVG attachments, alleged data theft and extortion, and law-enforcement action against the RedLine and META infostealer operations.
Key points
- WIRTE, believed to be associated with the Hamas-affiliated Gaza Cyber Gang, reportedly expanded operations to target Israeli entities using the SameCoin wiper.
- Google’s Threat Intelligence Group reported that suspected Russian-linked UNC5812 used a Telegram persona to deliver malware and conduct an influence operation targeting Ukraine’s military mobilization efforts.
- Researchers identified ToxicPanda as a distinct Android banking malware family; the roundup reports it had infected more than 1,500 devices.
- The roundup reports that international law enforcement disrupted the RedLine and META infostealer operations.
- Researchers observed phishing emails using SVG attachments to evade detection and create credential-stealing forms; FortiGuard Labs also found Winos 4.0 in gaming-related applications.
- U.S. authorities charged two suspected hackers over data theft from Snowflake customer accounts; the indictment says as many as 165 customers may have been affected.
Article Details
- Event Type
- Monthly roundup of cybersecurity news covering cyber operations, malware, law enforcement actions, phishing, and data theft.
- Impact
- The highlighted incidents include disruptive attacks against Israeli entities, malware targeting Ukrainian military personnel and Android users, alleged disclosure of classified U.S. intelligence, extortion and theft affecting U.S. victims, disruption of RedLine and META infostealer operations, phishing credential theft, and potential exposure of data from as many as 165 Snowflake customers. The article provides no specific indicators of compromise.
People
Asif W. RahmanFormer CIA employee charged with allegedly leaking classified U.S. intelligence documents.Connor Riley MouckaSuspected hacker indicted for allegedly hijacking Snowflake customer accounts and stealing data.John Erin BinnsSuspected hacker indicted for allegedly hijacking Snowflake customer accounts and stealing data.Robert PurbeckSentenced to 10 years in prison for hacking victims’ computer servers, stealing personal information, and attempted extortion.
Threat Actors
Gaza Cyber GangDescribed as Hamas-affiliated and associated with WIRTE.UNC5812Tracked suspected Russian espionage and influence operation targeting the Ukrainian military; used a Telegram persona named “Civil Defense” to deliver malware.WIRTEAPT described as believed to be associated with the Hamas-affiliated Gaza Cyber Gang; the article reports its operations targeted Israeli entities.
Malware
META6. Redline, Meta infostealer malware operations seized by police – Bleeping ComputerRedLine6. Redline, Meta infostealer malware operations seized by police – Bleeping ComputerSameCoin1. Hamas-Affiliated WIRTE Employs SameCoin Wiper in Disruptive Attacks Against Israel – The Hacker NewsToxicPanda4. New Android Banking Malware ‘ToxicPanda’ Targets Users with Fraudulent Money Transfers – The Hacker NewsWinos 4.08. Winos 4.0 Malware Infects Gamers Through Malicious Game Optimization Apps – The Hacker News
Vendors
CleafyThough initially believed to be associated with the TgToxic banking trojan family, analysts at Cleafy Threat Intelligence have identified “significant differences in the campaign’s code,” which has prompted the CleafyFortiGuard LabsResearchers at FortiGuard Labs have identified instances of the advanced malicious framework “Winos 4.0” being hidden in gaming-related applications.GoogleOn October 28, Google’s Threat Intelligence Group released a report exposing a suspected hybrid Russian espionage and influence operation targeting the Ukrainian military.Knownsecbeing used in the campaigns “Void Arachne” and “Silver Fox,” as documented by Trend Micro and the KnownSec 404 Team in June.Trend Microwas previously observed being used in the campaigns “Void Arachne” and “Silver Fox,” as documented by Trend Micro and the KnownSec 404 Team in June.
Products
Countries
AustraliaThe task force consisted of the Dutch National Police as well as authorities from the U.S., U.K., Belgium, Portugal, and Australia.BelgiumThe task force consisted of the Dutch National Police as well as authorities from the U.S., U.K., Belgium, Portugal, and Australia.Israel1. Hamas-Affiliated WIRTE Employs SameCoin Wiper in Disruptive Attacks Against Israel – The Hacker NewsPortugalThe task force consisted of the Dutch National Police as well as authorities from the U.S., U.K., Belgium, Portugal, and Australia.Ukrainemalware, UNC5812 is also carrying out an influence operation intended to undermine support for Ukraine’s mobilization efforts.United Stateswas sentenced to 10 years in prison “for hacking into the computer servers of 19 victims across the United States.” Purbeck also stole the personally identifiable information (PII) of more than 132,00 individuals and
Industries
Cloud ComputingAs noted in the indictment, Moucka and Binns used stolen access credentials to gain access to the victims’ Cloud Computing Instances and to download data.Healthcare5. Hacker gets 10 years in prison for extorting US healthcare provider – Bleeping ComputerMilitary2. Russian Espionage Group Targets Ukrainian Military with Malware via Telegram – The Hacker News