March Threat Intelligence Roundup: Ransomware Activity, Phishing and Major Intrusions
Summary
The roundup covers LockBit’s return after a law-enforcement takedown, phishing impersonating US agencies, threat campaigns targeting multiple regions and industries, Nemesis Market’s seizure, and Russian actors’ access to Microsoft systems.
Key points
- LockBit resumed operations on new infrastructure days after a global law-enforcement action and reportedly listed 12 new victims.
- The ALPHV/BlackCat group shut down its onion site after a reported $22 million ransom payment by UnitedHealth’s Change Healthcare unit; alleged gang members discussed the situation on RAMP.
- QR-code phishing PDFs impersonated the US Departments of Transportation and Agriculture and the Small Business Administration, directing victims to fake agency portals.
- Iranian actors reportedly used cloud infrastructure for command and control and social engineering to deliver the Minibike and Minibus backdoors against Middle East aerospace and aviation targets.
- German authorities, working with international partners, seized Nemesis Market infrastructure in Germany and Lithuania and $100,000 in cash.
- GhostSec and Stormous reportedly joined forces for double-extortion ransomware attacks across several sectors.
- A two-year campaign attributed to Chinese state-sponsored actors targeted government organizations in 45 countries; separately, Russian actors accessed Microsoft systems and senior executives’ emails, while Microsoft said it did not believe customer-facing systems were affected.
Article Details
- Event Type
- Roundup of reported ransomware operations, phishing campaigns, cyberespionage, and law-enforcement action.
- Impact
- Reported impacts included 12 new LockBit victims after the group resumed operations, phishing targeting users of US government agencies, cyber activity targeting aerospace and aviation industries in the Middle East, and unauthorized access to Microsoft source code, company systems, and senior executives’ emails. German and Lithuanian authorities seized Nemesis Market infrastructure. Microsoft said it did not believe customer-facing systems were accessed or affected; the nature of the Microsoft intrusion remained under investigation.
MITRE ATT&CK
Threat Actors
BlackCatRansomware group reported to have shut down its onion site after a purported $22 million ransom payment by UnitedHealth’s Change Healthcare unit.GhostSecRansomware group reported to have combined operations with Stormous to conduct double-extortion attacks.LockBitRansomware group reported to have resumed operations using new infrastructure after a law-enforcement takedown.SiegedSecCybercrime group reported to have announced the formation of “The Five Families” in August 2023.StormousRansomware group reported to have combined operations with GhostSec to conduct double-extortion attacks.
Malware
Vendors
Products
Countries
China7. China’s “Earth Krahang” infiltrates organizations throughout 45 countries – Bleeping ComputerGermanyGerman authorities, using intelligence from Lithuanian and American agencies and partners, captured infrastructure in both Germany and Lithuania, resulting in the take down of popular dark web Nemesis Market.LithuaniaGerman authorities, using intelligence from Lithuanian and American agencies and partners, captured infrastructure in both Germany and Lithuania, resulting in the take down of popular dark web Nemesis Market.NigeriaAll PDF’s had the same metadata, which indicated creation in Nigeria.RussiaAs of January 2024, Russian state-sponsored actors Cozy Bear (who are believed to be part of Russia’s SVR intelligence branch) accessed Microsoft source code and company systems.
Industries
Aerospace4. Iranian actors observed targeting aerospace and aviation industries in the Middle East – The Hacker NewsAviation4. Iranian actors observed targeting aerospace and aviation industries in the Middle East – The Hacker NewsEducationGhostSec and Stormous ransomware groups have combined their operations to conduct ransomware attacks against technology, education, government, and many more verticals.Government3. US government agencies are impersonated in business email compromise attacks – SC MediaTechnologyGhostSec and Stormous ransomware groups have combined their operations to conduct ransomware attacks against technology, education, government, and many more verticals.