September Threat Intelligence Roundup Covers Spyware Sanctions, Malware Campaigns and Takedowns
Summary
A roundup of September security news covers U.S. sanctions linked to Predator spyware, reported influence and malware campaigns, charges against Russian military officers, an FBI botnet disruption, and German cryptocurrency exchange seizures.
Key points
- The U.S. Treasury announced sanctions against five individuals and one entity linked to the Intellexa Consortium and Predator spyware.
- Chinese state-linked actors reportedly used fake U.S. voters and soldiers in the Operation Spamouflage influence campaign; some content was reportedly AI-generated.
- Researchers linked GreenCharlie to malware used in phishing campaigns targeting U.S. political campaigns and government entities.
- A malware campaign using the Voldemort backdoor reportedly sent more than 20,000 emails and targeted over 70 organizations; its operator remains unidentified.
- The U.S. indicted five Russian GRU officers and a civilian over an alleged conspiracy to hack Ukrainian government systems, exfiltrate data, and destroy systems.
- The FBI disrupted the Raptor Train botnet, which had reportedly infected more than 260,000 routers and IP cameras.
- German authorities announced the seizure of 47 cryptocurrency exchange services reportedly used by cybercriminals, including ransomware groups and botnet operators.
Article Details
- Event Type
- Threat intelligence roundup covering sanctions, influence operations, cyber espionage campaigns, malware and botnets, indictments, and law-enforcement seizures.
- Impact
- Reported activities include spyware targeting sensitive information, phishing and malware campaigns targeting political campaigns, government, defense, and other organizations, a botnet infecting more than 260,000 devices, and alleged attempts to hack, exfiltrate, leak, or destroy Ukrainian government data. The roundup also reports sanctions against individuals and an entity linked to Intellexa, criminal charges against five Russian GRU officers and one civilian, disruption of the Raptor Train botnet, and seizure of 47 cryptocurrency exchange services in Germany.
People
Threat Actors
CALANQUE IONNamed as a threat actor with which GreenCharlie reportedly overlaps.Charming KittenNamed as a threat actor with which GreenCharlie reportedly overlaps.DamselflyNamed as a threat actor with which GreenCharlie reportedly overlaps.GreenCharlieIranian threat actor linked to malware used in phishing campaigns for cyber espionage; reported to overlap with APT42, Mint Sandstorm, Charming Kitten, Damselfly, TA453, and Yellow Garuda.Mint SandstormNamed as a threat actor with which GreenCharlie reportedly overlaps.
Malware
GORBLEAccording to Insikt Group, GreenCharlie has been linked to POWERSTAR and GORBLE malware, both of which are used in phishing campaigns for cyber espionage.POWERSTARAccording to Insikt Group, GreenCharlie has been linked to POWERSTAR and GORBLE malware, both of which are used in phishing campaigns for cyber espionage.PredatorDepartment of the Treasury announced the sanctioning of five individuals and one entity linked to the Intellexa Consortium for the development of Predator spyware.Raptor TrainThe Federal Bureau of Investigation (FBI) has disrupted a Chinese state-sponsored botnet dubbed Raptor Train.Tickler8. New Tickler malware used to backdoor US govt, defense orgs – Bleeping ComputerVoldemort5. New Voldemort malware abuses Google Sheets to store stolen data – Bleeping ComputerWhisperGate“The GRU’s WhisperGate campaign, including targeting Ukrainian critical infrastructure and government systems of no military value, is emblematic of Russia’s abhorrent disregard for innocent civilians as it wages its
Vendors
Products
Azurein the “government, defense, satellite, oil and gas sectors,” and functions by leveraging Microsoft Azure infrastructure.Google Sheets5. New Voldemort malware abuses Google Sheets to store stolen data – Bleeping ComputerTelegram4. Telegram now shares users’ IP and phone number on legal requests – BleepingComputer
Countries
China2. China is pushing divisive political messages online using fake U.S. voters – NPRGermany9. Germany seizes 47 crypto exchanges used by ransomware gangs – Bleeping ComputerUkraineTopics have included reproductive rights, America’s policy towards Israel and support for Ukraine as well as criticizing both candidates.United Arab Emiratesgovernment and United Arab Emirates networks between April and July of this year.
Industries
Aerospacethe malware campaign remains unidentified, however, based on the targeted sectors—notably insurance, aerospace, and transportation—Proofpoint assesses that the purpose is likely cyber espionage.Cryptocurrency19 press release, the Federal Criminal Police Office of Germany (BKA) announced that it had seized 47 cryptocurrency exchange services hosted in Germany that were facilitating cybercriminal activity and were used forDefenseThe botnet notably targeted victims in the “military, government, higher education, telecommunications, defense industrial base (DIB), and IT sectors.” Read more.GovernmentAs highlighted in the press release, previous targets of the spyware have included “government officials, journalists, policy experts, and opposition politicians.” Full article here.Higher EducationThe botnet notably targeted victims in the “military, government, higher education, telecommunications, defense industrial base (DIB), and IT sectors.” Read more.Insuranceactor behind the malware campaign remains unidentified, however, based on the targeted sectors—notably insurance, aerospace, and transportation—Proofpoint assesses that the purpose is likely cyber espionage.Oil and gasthe new Tickler malware is being used to target organizations in the “government, defense, satellite, oil and gas sectors,” and functions by leveraging Microsoft Azure infrastructure.TelecommunicationsThe botnet notably targeted victims in the “military, government, higher education, telecommunications, defense industrial base (DIB), and IT sectors.” Read more.Transportationremains unidentified, however, based on the targeted sectors—notably insurance, aerospace, and transportation—Proofpoint assesses that the purpose is likely cyber espionage.