cyber.hendryadrian.com
Security News · darkowl.com

Security Roundup: LockBit Admin Sanctioned, Ascension Disrupted by Ransomware, and More

· Original article ↗

Summary

A roundup covers the identification and sanctions of LockBit’s administrator, ransomware disruption at Ascension, dating-app and USPS phishing schemes, Chinese-attributed espionage, arrests, a cryptocurrency theft, and vulnerable Tinyproxy servers.

Key points

  • Dmitry Yuryevich Khoroshev was identified as LockBit’s administrator and developer and sanctioned by the US, UK, and Australia; the article also reports five other members were arrested.
  • Fake dating-app verification sites collected users’ personal information and payment details, with information reportedly sold through criminal operations.
  • A suspected ransomware attack disrupted Ascension systems, delaying clinical tasks and prompting some ambulances to be redirected; no group had publicly claimed responsibility at the time.
  • Researchers reported that fake USPS sites received traffic comparable to the official site, with delivery-themed SMS messages directing users to malicious links.
  • A China-attributed actor called Unfading Sea Haze was reported to have targeted military and government networks for espionage, using spear-phishing, malicious LNK files, PowerShell, and malware.
  • The roundup also reports the arrest of the Incognito Market operator and charges against two brothers over an alleged $25 million Ethereum theft.
  • Cisco warned of CVE-2023-49606, a Tinyproxy remote-code-execution flaw; Censys reported about 90,000 internet-exposed services, more than half potentially vulnerable.

Article Details

Event Type
Threat intelligence news roundup covering ransomware, fraud, espionage, influence operations, cybercrime, cryptocurrency theft, and a proxy-server vulnerability.
Impact
Reported impacts include healthcare service disruption, theft and sale of personal information, ransomware activity, espionage and intelligence collection, cryptocurrency theft, and exposure to remote code execution. The roundup also reports arrests and sanctions connected to cybercrime.

MITRE ATT&CK

T1059.001 · PowerShellUnfading Sea Haze reportedly uses LNK files to execute a PowerShell script under certain circumstances.T1566.001 · Spearphishing AttachmentUnfading Sea Haze reportedly begins attacks with spear-phishing and sends documents containing LNK files.

CVE

CVE-2023-49606Cisco warned of a new flaw covered under CVE-2023-49606, which detailed a remote code execution issue that impacts incorrectly managed HTTP headers.

People

Dmitry Yuryevich KhoroshevIdentified in the article as the admin and developer of LockBit ransomware; the article reports that he was sanctioned by the US, UK, and Australia.Rui-Siang LinReportedly arrested in New York for operating Incognito Market.

Threat Actors

DoppelgangerKremlin-aligned group reported to use a botnet to spread fake news and influence public opinion.LockBitRansomware gang whose admin and developer was identified as Dmitry Yuryevich Khoroshev.Unfading Sea HazeThreat actor attributed to China and reported to have conducted espionage and intelligence collection on military and government networks in the South China Sea.

Malware

GhostRATThey also use a custom keylogger named “xkeylog” as well as some GhostRAT malware variants.xkeylogThey also use a custom keylogger named “xkeylog” as well as some GhostRAT malware variants.

Vendors

CiscoCisco warned of a new flaw covered under CVE-2023-49606, which detailed a remote code execution issue that impacts incorrectly managed HTTP headers.

Products

Telegramand their other PII is sold in criminal operations on dark web markets, as well as in certain cases, on Telegram.Tinyproxy9. Over 50,000 Tinyproxy servers vulnerable to critical RCE flaw – Bleeping ComputerXIn what has become a normal operation for Russian intel operatives, the Kremlin is using Telegram, bot farms, and other social media platforms such as X (formerly Twitter) to increase division in US society.

Countries

ChinaA new threat actor attributed to China, “Unfading Sea Haze,” has been hiding on military and government networks in the South China Sea for the past six years.United Statespublications, including Le Monde and other European new networks, as well as news outlets in the United States.

Industries

GovernmentA new threat actor attributed to China, “Unfading Sea Haze,” has been hiding on military and government networks in the South China Sea for the past six years.HealthcareIn another example of the digital realm having a physical impact, US-based Ascension healthcare had to change the destination hospital for several ambulances when a ransomware attack impacted their systems.Military5. Chinese hackers hide on military and govt networks for 6 years – Bleeping Computer

Related Articles