Cybersecurity Roundup: Ransomware Arrests, Phishing Campaigns and Threat Group Activity
Summary
A roundup covers arrests linked to Conti and LockBit, CISA impersonation scams, phishing services targeting financial firms, campaigns against critical infrastructure, a newly identified North Korean group, and criminal-marketplace enforcement.
Key points
- Dutch and Ukrainian police announced the April arrest of a man accused of developing stealthy ransomware payloads for Conti and LockBit and participating in an attack.
- CISA warned that callers are impersonating its employees to solicit cryptocurrency, gift cards, cash, and other payments.
- The ONNX phishing service uses QR codes in PDF attachments and Telegram bots to target Microsoft 365 accounts at financial firms; the roundup says it can bypass MFA.
- The roundup describes ransomware and espionage campaigns targeting global infrastructure from 2021 to 2023, involving ChamelGang and CatB.
- Microsoft identified Moonstone Sleet, a North Korean-linked group observed using fake companies to target job applicants and deploying trojans and, in some cases, custom ransomware.
- BreachForums returned after a law-enforcement takedown, while US prosecutors charged two alleged Empire Market operators over transactions valued at about $430 million.
Article Details
- Event Type
- Monthly threat-intelligence roundup covering arrests, impersonation scams, phishing services, ransomware activity, and criminal marketplaces.
- Impact
- Reported threats include ransomware and espionage targeting critical infrastructure, CISA employee impersonation for financial gain, and phishing campaigns targeting Microsoft 365 accounts and European financial institutions. The roundup also reports law-enforcement arrests and charges involving ransomware and online criminal marketplaces.
People
Raheim HamiltonNamed as the real name of the Empire Market operator using the alias “Sydney/Zero Angel,” who was charged by the U.S. Department of Justice.Thomas PaveyNamed as the real name of the Empire Market operator using the alias “Dopenugget,” who was charged by the U.S. Department of Justice.
Threat Actors
CamoFeiPresented in parentheses as an alternate name for ChamelGang.ChamelGangIdentified as a group involved in attacks targeting governments and critical infrastructure between 2021 and 2023; the article states it also uses Cobalt Strike.Lazarus GroupThe article reports that Moonstone Sleet has overlap with Lazarus Group in some instances, while having distinct tactics and infrastructure.Moonstone SleetNew North Korean hacker group reported to use fake companies to lure job applicants and deploy trojans and, in some cases, custom ransomware.
Malware
Vendors
Microsoft4. ONNX phishing service targets Microsoft 365 accounts at financial firms – Bleeping ComputerRockwell Automationaround the globe and constant connectedness of devices, industrial control system (ICS) experts Rockwell Automation emphasized Cybersecurity and Infrastructure Security Agency’s (CISA) previous warning about water
Products
Cobalt StrikeChamelGang also uses Cobalt Strike in its operations.Microsoft 365 Apps for Enterprise4. ONNX phishing service targets Microsoft 365 accounts at financial firms – Bleeping ComputerONNX StoreA new Phishing-as-a-service (PhaaS) platform, ONNX Store, is using Microsoft 365 accounts to target employees of the financial sector using malicious QR codes in PDF attachments.
Tools
Countries
AustriaA new “V3B” phishing kit is on Telegram, used to target financial institutions in the Netherlands, Austria and Germany, Finland, Italy, and several other European countries.ChinaRussia, Iran, and China are all leading malicious campaigns to disrupt daily services and stoke fear among civilian populations.FinlandA new “V3B” phishing kit is on Telegram, used to target financial institutions in the Netherlands, Austria and Germany, Finland, Italy, and several other European countries.GermanyA new “V3B” phishing kit is on Telegram, used to target financial institutions in the Netherlands, Austria and Germany, Finland, Italy, and several other European countries.IranRussia, Iran, and China are all leading malicious campaigns to disrupt daily services and stoke fear among civilian populations.ItalyA new “V3B” phishing kit is on Telegram, used to target financial institutions in the Netherlands, Austria and Germany, Finland, Italy, and several other European countries.NetherlandsA new “V3B” phishing kit is on Telegram, used to target financial institutions in the Netherlands, Austria and Germany, Finland, Italy, and several other European countries.RussiaRussia, Iran, and China are all leading malicious campaigns to disrupt daily services and stoke fear among civilian populations.UkraineThe Dutch police and the Ukraine cyber police revealed this week that they arrested a man in April, 2024, who worked with both Conti and LockBit ransomware gangs.