October Threat Intelligence Roundup Covers Domain Seizures, Arrests and New Malware
Summary
DarkOwl’s roundup summarizes October cybersecurity news, including U.S. and Microsoft domain seizures, law-enforcement actions against cybercrime suspects and markets, and reports on new malware, a botnet and a China-aligned threat actor.
Key points
- The U.S. DOJ and Microsoft seized 107 domains allegedly used in a Russian government phishing campaign to steal sensitive information.
- Authorities announced arrests linked to LockBit and sanctions against people tied to LockBit and Evil Corp; three Iranian nationals were also indicted over alleged election interference and cybercrimes.
- Researchers reported a Linux variant of FASTCash malware used to target payment switch systems and enable unauthorized ATM cash withdrawals.
- ESET identified CeranaKeeper, a China-aligned threat actor observed targeting government entities in Southeast Asia and elsewhere since early 2022.
- NSFOCUS reported that Gorilla Botnet issued more than 300,000 attack commands between September 4 and 27, affecting targets in over 100 countries.
- A joint law-enforcement operation dismantled the Bohemia/Cannabia dark-web markets and seized more than €8 million in cryptocurrency from arrested administrators.
Article Details
- Event Type
- Monthly roundup of cybersecurity news covering law-enforcement actions, cybercrime, malware, threat activity, and service restrictions.
- Impact
- Reported impacts include the seizure of domains used in phishing, arrests and sanctions linked to ransomware and cybercrime operations, alleged attempts to interfere with U.S. elections, ATM cash theft using FASTCash, data-exfiltration targeting of government entities, and large-scale DDoS activity. Discord was blocked in Russia and Turkey. The article provides no further operational or financial impact details.
People
Threat Actors
Anonymous SudanHacktivist group alleged to have carried out DDoS attacks.CeranaKeeperChina-aligned threat actor reported to have targeted governmental entities, predominantly in Southeast Asia.Evil CorpRussian cyber-crime gang described as linked to a sanctioned LockBit affiliate.LockBitRansomware gang linked to individuals arrested in the reported law-enforcement actions.
Malware
Vendors
ESETResearchers at the cybersecurity firm ESET have identified a new China-aligned threat actor dubbed CeranaKeeper.Microsoft2. U.S. and Microsoft Seize 107 Russian Domains in Major Cyber Fraud Crackdown – The Hacker NewsNSFOCUSCybersecurity researchers from NSFOCUS have discovered a new botnet malware family dubbed “Gorilla Botnet.” According to the cybersecurity firm’s report, between September 4 and September 27, the botnet issued “over
Products
Countries
AustraliaIn addition to the four arrests, the United States, United Kingdom, and Australia also announced sanctions against an actor the UK’s National Crime Agency identified as a “prolific affiliate of LockBit and stronglyChina6. China-Linked CeranaKeeper Targeting Southeast Asia with Data Exfiltration – The Hacker NewsIranpolitical campaigns,” as part of Iran’s continued efforts to sow discord and influence U.S.IrelandThe international law enforcement operation, which was carried out with the U.K., U.S., and Ireland, resulted in the dismantling of the dual marketplace, which was one of the world’s largest and longest runningJapanTargets have included Thailand, Myanmar, the Philippines, Japan, and Taiwan.MyanmarTargets have included Thailand, Myanmar, the Philippines, Japan, and Taiwan.PhilippinesTargets have included Thailand, Myanmar, the Philippines, Japan, and Taiwan.Russia1. Discord blocked in Russia and Turkey for spreading illegal content – Bleeping ComputerSpainA fourth suspect—believed to be the administrator of a bulletproof hosting service used by LockBit—was arrested in Madrid by Spain’s Guardia Civil.Sudan7. US disrupts Anonymous Sudan DDoS operation, indicts 2 Sudanese brothers – Bleeping ComputerTaiwanTargets have included Thailand, Myanmar, the Philippines, Japan, and Taiwan.ThailandTargets have included Thailand, Myanmar, the Philippines, Japan, and Taiwan.Turkey1. Discord blocked in Russia and Turkey for spreading illegal content – Bleeping ComputerUnited KingdomIn addition to the four arrests, the United States, United Kingdom, and Australia also announced sanctions against an actor the UK’s National Crime Agency identified as a “prolific affiliate of LockBit and stronglyUnited StatesIn addition to the four arrests, the United States, United Kingdom, and Australia also announced sanctions against an actor the UK’s National Crime Agency identified as a “prolific affiliate of LockBit and strongly
Industries
communicationsOn October 8, Russian state-owned news agency TASS reported that Russia’s communications regulator blocked Discord “for violating Russian law.” A day later, on October 9, Turkish authorities announced that it too hadCritical infrastructurehas conducted “over 35,000 DDoS attacks in a year” targeting a variety of sectors, including “critical infrastructure, corporate networks, and government agencies in the United States and around the world.” ReadEducationcommands, with a shocking attack density.” The botnet has targeted a variety of sectors, including education, government, finance, and communications.financeshocking attack density.” The botnet has targeted a variety of sectors, including education, government, finance, and communications.GovernmentAccording to the DOJ’s press release, the domains were used in a phishing campaign run by the Russian government to steal American citizens’ sensitive information.