Cybersecurity Roundup Covers Malware, Ransomware and Phishing Developments
Summary
A cybersecurity digest summarizes reports on malware campaigns, Iranian-linked cyber operations, a ransomware payment, breaches of South Korean defense contractors, help-desk attacks, card theft, phishing, and SIM swapping.
Key points
- A March 2024 email campaign targeting German organizations delivered the Rhadamanthys infostealer; the code may have been AI-authored, and TA547 was cited as a possible author.
- The U.S. Treasury sanctioned Iranian individuals and front companies over cyber operations targeting U.S. military veterans, defense contractors, and government entities.
- UnitedHealth confirmed paying BlackCat/ALPHV in February 2024 to prevent the sale of private healthcare data; a blockchain transaction was cited as evidence of payment.
- North Korean groups, including Lazarus and Kimsuky, reportedly used vulnerabilities and a compromised employee account to target South Korean defense contractors and obtain technological information.
- The U.S. Department of Health and Human Services warned that attackers impersonate legitimate callers to persuade healthcare IT help desks to enroll attacker-controlled devices in corporate MFA.
- Russian prosecutors charged six people over the alleged theft of 160,000 payment cards using malware over seven years.
- Other reported activity included a phishing campaign targeting Spanish speakers in Latin America and attempts to recruit U.S. carrier employees into SIM-swapping operations.
Article Details
- Event Type
- Weekly roundup of reported cyber incidents, threat activity, and government actions.
- Impact
- The reports describe malware and ransomware activity, theft or threatened disclosure of sensitive data, phishing and social engineering targeting organizations and individuals, and cybercrime operations involving forced labor. Reported targets include German organizations, US government and defense entities, healthcare organizations, South Korean defense contractors, and mobile phone users.
MITRE ATT&CK
Threat Actors
ALPHVIdentified alongside BlackCat as a ransomware actor paid in February 2024 to prevent the sale of private healthcare data.BlackCatIdentified as a ransomware actor paid in February 2024 to prevent the sale of private healthcare data; the article pairs the name with AlphV.LazarusNamed as a North Korean hacking group that breached South Korean defense contractors and targeted technological information.Scully SpiderThe article identifies Scully Spider as another name for TA547, which it says possibly authored a March 2024 email campaign targeting German organizations.TA547Described as a possible author of a March 2024 email campaign targeting German organizations; the article identifies TA547 as also known as Scully Spider.
Malware
Vendors
T-MobileIn SIM swapping incidents, actors fool a wireless carrier, such as Verizon or T-Mobile (who were both targeted in this latest campaign) into rerouting services to a device controlled by the criminals themselves.VerizonIn SIM swapping incidents, actors fool a wireless carrier, such as Verizon or T-Mobile (who were both targeted in this latest campaign) into rerouting services to a device controlled by the criminals themselves.
Countries
Cambodia4. Indian Government Rescues 250 Citizens Forced into Cybercrime in Cambodia – The Hacker NewsIndiaIndia’s government issued a public statement and update about the rescue of 250 Indian nationals who went to Cambodia under the pretense of employment but were then forced to participate in cybercrime.MyanmarOther hotspots observed for this kind of activity include Myanmar, Thailand, and the Philippines.PhilippinesOther hotspots observed for this kind of activity include Myanmar, Thailand, and the Philippines.Russia7. Russia charges suspects behind theft of 160,000 credit cards – Bleeping ComputerThailandOther hotspots observed for this kind of activity include Myanmar, Thailand, and the Philippines.
Industries
DefenseTheir operations used spear phishing and social engineering to target US military veterans, US defense contractors, and other US government entities.HealthcareUnited Health publicly admitted that they paid BlackCat/AlphV ransomware actors in February 2024 to prevent the sale of private healthcare data to criminal actors.