November Threat Intelligence Roundup Covers Espionage, Ransomware and Phishing
Summary
A November roundup highlights reporting on Middle East cyber espionage, ransomware claims and disruption, alleged data access, phishing services, and ransomware-group activity.
Key points
- A reported Iranian cyber-espionage campaign targeted entities across six Middle Eastern countries over eight months, using custom web shells and backdoors.
- LockBit claimed it breached Boeing, but the roundup said the group had offered no proof of Boeing data or materials.
- IntelBroker claimed access to GE and DARPA data; GE confirmed an incident but provided no further details in the cited report.
- A ransomware attack disrupted services at 30 Ardent Health hospitals, with emergency services redirected across six states.
- Researchers reported that Prolific Puma used large numbers of domains for link-shortening services associated with phishing, malware, and scams.
- The Telekopye Telegram bot was reportedly used to facilitate seller, buyer, and refund phishing scams that sought payment details.
- The roundup also noted AlphaLock’s advertised services and a Russian-speaking actor’s reported ties to five ransomware operations.
Article Details
- Event Type
- Monthly roundup of cybersecurity news and threat-intelligence reports
- Impact
- The roundup reports alleged and confirmed security incidents, ransomware activity affecting organizations and hospitals, phishing scams, and cyber-espionage targeting in the Middle East. It notes that some breach claims were unsubstantiated or lacked details.
Threat Actors
AlphaLockRussian cyber group described as advertising services and courses and seeking to establish a marketplace for pentesting services.IntelBrokerActor who claimed access to General Electric and DARPA and purportedly offered credentials and sensitive data for sale; General Electric confirmed an incident but gave no further details.LockBitRansomware group that claimed to have infiltrated Boeing's systems; the article says it offered no proof of Boeing data or material.NeanderthalsCriminal group described as using the Telekopye Telegram bot in seller, buyer, and refund scams.Prolific PumaThreat actor described as distributing phishing services, malware, and scams through link-shortening services and abusing DNS infrastructure.
Malware
JSWORMRussian-speaking actor “farnetwork” contributed to the Nokoyawa RaaS operation as a project leader and recruiter, and contributed to the development of JSWORM, Nefilim, Karma, and Nemty ransomware variants.KarmaRussian-speaking actor “farnetwork” contributed to the Nokoyawa RaaS operation as a project leader and recruiter, and contributed to the development of JSWORM, Nefilim, Karma, and Nemty ransomware variants.NefilimRussian-speaking actor “farnetwork” contributed to the Nokoyawa RaaS operation as a project leader and recruiter, and contributed to the development of JSWORM, Nefilim, Karma, and Nemty ransomware variants.NemtyRussian-speaking actor “farnetwork” contributed to the Nokoyawa RaaS operation as a project leader and recruiter, and contributed to the development of JSWORM, Nefilim, Karma, and Nemty ransomware variants.NokoyawaRussian-speaking actor “farnetwork” contributed to the Nokoyawa RaaS operation as a project leader and recruiter, and contributed to the development of JSWORM, Nefilim, Karma, and Nemty ransomware variants.
Products
Ardent Health Services30 hospitals in the Ardent Health Services system have been hit by a ransomware attack, resulting in all emergency services being redirected.Boeing2. Boeing Breached by Ransomware, LockBit Gang Claims – Dark ReadingDARPA3. General Electric, DARPA Hack Claims Raise National Security Concerns – Dark ReadingGeneral Electric3. General Electric, DARPA Hack Claims Raise National Security Concerns – Dark ReadingTelegram6. Cybercriminals Using Telekopye Telegram Bot to Craft Phishing Scams on a Grand Scale – The Hacker News
Tools
Countries
IraqVictims include Jordan, Kuwait, Oman, Iraq, Israel, and Saudi Arabia.IsraelVictims include Jordan, Kuwait, Oman, Iraq, Israel, and Saudi Arabia.JordanVictims include Jordan, Kuwait, Oman, Iraq, Israel, and Saudi Arabia.KuwaitVictims include Jordan, Kuwait, Oman, Iraq, Israel, and Saudi Arabia.OmanVictims include Jordan, Kuwait, Oman, Iraq, Israel, and Saudi Arabia.Saudi ArabiaVictims include Jordan, Kuwait, Oman, Iraq, Israel, and Saudi Arabia.