July Threat Intelligence Roundup Highlights Breaches, Malware, and Disruptions
Summary
A July roundup covers the AT&T customer-data breach, malware campaigns, cybercrime indictments and disruptions, ransomware claims, and attackers exploiting CrowdStrike-related outages to spread malware.
Key points
- AT&T confirmed a breach affecting nearly all wireless customers; stolen records included call and text data from specified periods in 2022 and 2023.
- GuardZoo Android surveillanceware reportedly affected more than 450 military personnel across seven Middle Eastern countries, with most victims in Yemen.
- Four Vietnamese nationals linked to FIN9 were indicted over alleged cybercrime activity involving phishing, social engineering, supply-chain attacks, and data theft.
- U.S. authorities disrupted a Russian AI-powered bot operation, seizing two domains and searching nearly 1,000 bot accounts that were later suspended on X.
- Threat actors impersonated CrowdStrike in phishing emails to distribute malware and data wipers amid disruption caused by a faulty software update.
- LockBit claimed a Federal Reserve hack, but analysis indicated the published data came from Evolve Bank and Trust; the bank said it was investigating an incident without confirming further details.
- The roundup also reports malware targeting a Ukrainian research institution and U.S. indictments and a reward offer related to alleged support for Russia’s WhisperGate attack.
Article Details
- Event Type
- Roundup of cybersecurity incidents, threat activity, and law enforcement actions
- Impact
- Reported events included a data breach affecting nearly all AT&T wireless customers; malware surveillance targeting more than 450 Middle Eastern military personnel; cybercrime, phishing, and ransomware activity; disruption of a Russian AI-powered bot operation; and malware campaigns targeting organizations in Ukraine and companies seeking CrowdStrike fixes. The article also reports that a faulty CrowdStrike update disabled an estimated 8.5 million Windows computers worldwide. Some reported claims remain allegations or attributed assessments, including the alleged role of Amin Timovich Stigal and the moderate-confidence link between UAC-0063 and APT28.
MITRE ATT&CK
People
Threat Actors
APT28UAC-0063 has been linked to APT28 with moderate confidence; the article describes APT28 as a Russian GRU-backed threat actor.FIN9Four Vietnamese individuals described as FIN9 actors were indicted for cybercrime activity from May 2018 to October 2021.LockBitThe ransomware group claimed to have hacked the U.S. Federal Reserve; the article reports that the published data was actually from Evolve Bank and Trust.Scattered SpiderMicrosoft reportedly linked this cybercrime group to attacks using RansomHub and Qilin ransomware.UAC-0063CERT-UA attributed attacks on Ukrainian state bodies, including a spear-phishing campaign targeting a research institution, to this threat actor.
Malware
Agenda“Knight.” Qilin ransomware, meanwhile, first emerged in August of 2022 and was initially referred to as “Agenda.” Read more.CHERRYSPY7. Ukrainian Institutions Targeted Using HATVIBE and CHERRYSPY Malware – The Hacker NewsDendroid RATGuardZoo is a modification of Dendroid RAT malware which targets Android OS and was first discovered in 2014.GuardZoo2. GuardZoo Malware Targets Over 450 Middle Eastern Military Personnel – The Hacker NewsHATVIBE7. Ukrainian Institutions Targeted Using HATVIBE and CHERRYSPY Malware – The Hacker NewsKnightwas first observed in February of 2024 and is believed to be a rebrand of the ransomware strain “Knight.” Qilin ransomware, meanwhile, first emerged in August of 2022 and was initially referred to as “Agenda.”Qilin9. Microsoft links Scattered Spider hackers to Qilin ransomware attacks – BleepingComputerRansomHubAccording to Microsoft, the cybercrime group Scattered Spider has added RansomHub and Qilin ransomware to its arsenal and has begun utilizing them in its attacks.WhisperGatenational Amin Timovich Stigal for allegedly assisting Russia’s military intelligence service’s “WhisperGate” cyberattack by distributing malware to Ukrainian government computer networks a month prior to the
Vendors
Products
AndroidMilitary personnel in the Middle East have been targeted by GuardZoo malware, an Android data-gathering tool.Microsoft WindowsOn July 19, the cybersecurity company CrowdStrike distributed a faulty software update to its customers; the update affected devices running Windows, and an estimated 8.5 million computers worldwide were disabled.X4. US disrupts AI-powered bot farm pushing Russian propaganda on X – BleepingComputer
Countries
EgyptOver 450 victims across Egypt, Oman, Qatar, Saudi Arabia, Turkey, the U.A.E., and Yemen have been impacted by the surveillanceware operation, with the majority of victims located in Yemen.OmanOver 450 victims across Egypt, Oman, Qatar, Saudi Arabia, Turkey, the U.A.E., and Yemen have been impacted by the surveillanceware operation, with the majority of victims located in Yemen.QatarOver 450 victims across Egypt, Oman, Qatar, Saudi Arabia, Turkey, the U.A.E., and Yemen have been impacted by the surveillanceware operation, with the majority of victims located in Yemen.RussiaAccording to the DOJ press release, the bot farm was developed by the deputy editor-in-chief of RT (formerly Russia Today), the state-controlled news organization.Saudi ArabiaOver 450 victims across Egypt, Oman, Qatar, Saudi Arabia, Turkey, the U.A.E., and Yemen have been impacted by the surveillanceware operation, with the majority of victims located in Yemen.TurkeyOver 450 victims across Egypt, Oman, Qatar, Saudi Arabia, Turkey, the U.A.E., and Yemen have been impacted by the surveillanceware operation, with the majority of victims located in Yemen.UkraineUkraine’s Computer Emergency Response Team (CERT-UA) revealed that a Ukrainian research institution has been targeted by HATVIBE and CHERRYSPY malware distributed in a spear-phishing campaign.United StatesDepartment of Justice announced the disruption of a Russian, AI-powered information operation devised to spread Russian propaganda in the United States and abroad.YemenOver 450 victims across Egypt, Oman, Qatar, Saudi Arabia, Turkey, the U.A.E., and Yemen have been impacted by the surveillanceware operation, with the majority of victims located in Yemen.