June Threat Intelligence Roundup Highlights Malware, Attacks and Law-Enforcement Action

Summary

A June roundup highlights ransomware-related data concerns and DDoS warnings in Switzerland, arrests following the EncroChat takedown, and reported malware and campaign activity targeting aerospace, diplomatic and other organizations.

Key points

The Swiss government said an IT supplier was hit by ransomware and its data may have been affected; it also warned of ongoing DDoS attacks.
Europol announced more than 6,600 arrests and $979 million in seized illicit funds following the EncroChat takedown.
APT37 is believed to be using FadeStealer, an information stealer with a microphone-recording feature.
Adlumin discovered PowerDrop, a PowerShell malware script found in a U.S. defense contractor’s network; the roundup says it was used against the U.S. aerospace defense industry.
The roundup says Chinese state-sponsored actor Flea targeted foreign affairs ministries in the Americas from late 2022 into early 2023 using the Graphican backdoor.
CERT-UA reported a UAC-0006 campaign distributing SmokeLoader through compromised email accounts and multiple delivery methods.

Article Details

Event Type: Monthly threat intelligence news roundup covering cyberattacks, law-enforcement actions, and malware activity.
Impact: Reported events included a ransomware attack affecting an IT supplier to the Swiss government, with government data potentially impacted; DDoS attacks that the Swiss government said were not targeting it; the EncroChat takedown, followed by more than 6,600 arrests and $979 million seized; alleged APT37 use of FadeStealer to record victims through their microphones; discovery of PowerDrop in a U.S. defense contractor’s network during attacks on the U.S. aerospace defense industry; Flea targeting foreign affairs ministries in the Americas; and a CERT-UA-reported campaign distributing SmokeLoader through compromised email accounts and multiple delivery methods.