February Threat Intelligence Roundup Covers LockBit Takedown, Malware Campaigns and Breaches
Summary
A February roundup covers law-enforcement actions against LockBit and Warzone RAT, phishing and malware campaigns, alleged data theft, and a ransomware attack that Johnson Controls said cost $27 million.
Key points
- A global law-enforcement operation took LockBit offline, obtained its source code, arrested two members, and froze 200 cryptocurrency accounts, according to the roundup.
- The FBI seized four domains connected to Warzone RAT and arrested two people in actions with Maltese and Nigerian connections.
- Bumblebee malware was reportedly used in phishing campaigns targeting thousands of US organizations; its distribution and use were not attributed to a specific group.
- A campaign reported in November and December 2023 used spear-phishing emails to harvest Microsoft credentials and spread conflict-related disinformation; no specific Russian actor was identified.
- The roundup says Chinese actors exploited Fortinet vulnerability CVE-2022-42475 to deploy the COATHANGER backdoor on a network used by the Dutch military.
- The ResumeLooters group reportedly stole millions of records from retail and employment websites using XSS and SQL injection, then offered the data for sale.
- Johnson Controls said a ransomware attack caused $27 million in costs, disrupted customer-facing systems, and resulted in the loss of 27 TB of corporate information.
Article Details
- Event Type
- February threat intelligence roundup covering law-enforcement disruption of cybercrime operations, ransomware incidents, malware campaigns, credential theft, espionage, and network intrusions.
- Impact
- Reported impacts included the shutdown of LockBit infrastructure, arrests and cryptocurrency-account freezes, seizure of Warzone RAT domains, theft of millions of career records and 27 TB of corporate information, disruption to customer-facing systems, and access to a network used by the Dutch military. Other reports described phishing and credential-harvesting campaigns targeting organizations and individuals.
CVE
Threat Actors
ContiReported as one of the groups believed to have developed Bumblebee.LockBitRansomware operation disrupted by a global law-enforcement operation.ResumeLootersThreat actor group reported to have stolen millions of career records.Trickbot GroupReported as one of the groups believed to have developed Bumblebee.
Malware
BumbleBee3. Bumblebee Malware Buzzes Back on the Scene After 4-Month Hiatus – Dark ReadingCOATHANGERof intel, China exploited an extant Fortinet vulnerability (CVE-2022-42475) to deploy a backdoor named COATHANGER and gain access to a network used by the Dutch military.LockBit1. LockBit Ransomware Operation Shut Down; Criminals Arrested; Decryption Keys Released – The Hacker NewsPegasus RATThe individual based in Malta was also reported to have sold the Pegasus RAT for the Skynet corporation.Warzone RAT2. FBI seizes Warzone RAT infrastructure, arrests malware vendor – Bleeping Computer
Vendors
Products
Countries
ChinaContinuing their world-wide efforts to infiltrate government, military, and key sources of intel, China exploited an extant Fortinet vulnerability (CVE-2022-42475) to deploy a backdoor named COATHANGER and gain accessUkraine4. Russian Hackers Target Ukraine with Disinformation and Credential-Harvesting Attacks – The Hacker News
Industries
Defense8. New Report Reveals North Korean Hackers Targeting Defense Firms Worldwide – The Hacker NewsEmploymentThe specifically targeted sector was retail, along with multiple general employment websites.Military5. Chinese Hackers Exploited FortiGate Flaw to Breach Dutch Military Network – The Hacker NewsRetailThe specifically targeted sector was retail, along with multiple general employment websites.