July Threat Intelligence Roundup Covers Malware Campaigns and Data Breaches
Summary
A July roundup highlights reporting on information stealers, ransomware and spyware campaigns, attacks targeting European ministries, and data breaches affecting Deutsche Bank customers and HCA patients.
Key points
- Meduza Stealer was reported to target password managers and cryptocurrency wallets while evading detection.
- Big Head ransomware reportedly spread through fake Windows updates and encrypted victims’ files.
- BlackCat/ALPHV used malvertising impersonating WinSCP to target IT professionals and administrators.
- A Chinese nation-state group reportedly used HTML smuggling to deliver PlugX while targeting European foreign ministries and embassies.
- The roundup describes APT41-linked Android spyware strains WyrmSpy and DragonEgg.
- Deutsche Bank confirmed a service-provider breach that exposed customer data; the article says it was likely related to the MOVEit data-theft attacks.
- HCA Healthcare said a breach affected 11 million patients; a threat actor reportedly leaked samples and offered patient records for sale.
Article Details
- Event Type
- Monthly roundup of cybersecurity news, including malware campaigns, ransomware activity, and data breaches.
- Impact
- The featured reports describe password- and wallet-stealing malware, ransomware and spyware campaigns, and breaches affecting Deutsche Bank customers and 11 million HCA Healthcare patients. Other reported activity targeted European foreign affairs ministries and embassies, corporate networks, and mobile devices.
MITRE ATT&CK
Threat Actors
ALPHVIdentified as an alternate name for the BlackCat ransomware group.AxiomListed by the article as an alias for APT41.BlackCatIdentified as a ransomware group running malvertising campaigns; the article says it is also known as ALPHV.BlackflyListed by the article as an alias for APT41.SPIRE CASTLEChina-linked nation-state actor associated with WyrmSpy and DragonEgg; the article explicitly lists the following names as aliases.
Malware
Big Head2. Beware of Big Head Ransomware: Spreading Through Fake Windows Updates – The Hacker NewsDragonEgg5. Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware – The Hacker NewsMeduza Stealer1. Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets – The Hacker NewsPlugX4. Chinese Hackers Use HTML Smuggling to Infiltrate European Ministries with PlugX – The Hacker NewsWyrmSpy5. Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware – The Hacker News
Products
AndroidThe China-linked nation-state actor, APT41 (aka Axiom, Blackfly, Brass Typhoon, Bronze Atlas, HOODOO, Wicked Panda, and Winnti) is known for their strains of Android spyware called WrymSpy and DragonEgg.Microsoft WindowsEarly July, researchers found a newly created Windows-based information stealer going by the name of Meduza Stealer that is designed to evade detection by software solutions.Progress MOVEit Transferof their services providers had experienced a data breach that exposed customers’ data – likely a MOVEit Transfer data-theft attack, related to CL0P’s ransomware wave of MOVEit attacks.WinSCP3. BlackCat ransomware pushed Cobalt Strike via WinSCP search ads – Bleeping Computer
Tools
Countries
ChinaThe China-linked nation-state actor, APT41 (aka Axiom, Blackfly, Brass Typhoon, Bronze Atlas, HOODOO, Wicked Panda, and Winnti) is known for their strains of Android spyware called WrymSpy and DragonEgg.FranceThe majority of victims have been in the U.S., Spain, France, and Turkey.SpainThe majority of victims have been in the U.S., Spain, France, and Turkey.TurkeyThe majority of victims have been in the U.S., Spain, France, and Turkey.United StatesThe majority of victims have been in the U.S., Spain, France, and Turkey.