April Cybersecurity Roundup Covers QuaDream Spyware, Data Breaches and Malware
Summary
A monthly roundup highlights reporting on SNAP benefit trafficking, QuaDream spyware attacks, a Kodi forum database breach, Blind Eagle and APT35 campaigns, and JavaScript malware served by eFile.com.
Key points
- The roundup describes research into cybercriminals trafficking stolen food-assistance benefits through darknet marketplaces.
- Citizen Lab said QuaDream spyware used invisible, backdated iCloud calendar invites to exploit iPhones; the attacks reportedly included self-deletion.
- Kodi said attackers used old staff credentials to access its MyBB forum administrator console and steal a database containing posts, private messages, and credentials.
- Blind Eagle was linked to a multi-stage attack chain leading to NjRAT on compromised systems, with targets reported in Colombia and other countries.
- Researchers found JavaScript malware on eFile.com that reportedly provided a backdoor for remote access; the article says the file no longer contained the malware.
- APT35 was associated with phishing attacks targeting Israel, using techniques that include fake social media personas and spear-phishing.
Article Details
- Event Type
- Cybersecurity threat-intelligence roundup covering benefits theft, spyware and malware attacks, data breaches, cyber espionage, and phishing.
- Impact
- Reported incidents included theft and trafficking of welfare benefits; iPhones compromised by QuaDream spyware; exposure of Kodi forum data, private messages, and credentials; attacks attributed to Blind Eagle and APT35; malware served through eFile.com; and phishing targeting Israel. Kodi advised users to treat their passwords as compromised. The eFile.com incident was reported as limited to that site and not affecting the IRS e-file infrastructure.
MITRE ATT&CK
Threat Actors
Malware
njRATCyber threat actor, Blind Eagle, also referred to as APT-C-36, has been linked to multi-stage attack chain which leads to NjRAT remote access trojan on compromised systems.popper.jsThe JavaScript malware being used is popper.js.PowerLess Backdoor6. Iranian Hackers Launch Sophisticated Attacks Targeting Israel with PowerLess Backdoor – The Hacker News
Vendors
Products
eFile.com5. IRS-authorized eFile.com tax return software caught serving JS malware – Bleeping ComputeriPhonewithout the user’s knowledge because when calendar invites with dates from the past are received by an iPhone they are automatically added to the calendar.Kodi3. Kodi discloses data breach after forum database for sale online – BleepingComputerMyBBThe Kodi Foundation has announced that that they suffered a data breach after their MyBB forum database was stolen.
Countries
ChileBlind Eagle is thought to be a Spanish-speaking group and is targeting mainly private and public entities in Colombia, but also expanding to Ecuador, Chile, and Spain.ColombiaBlind Eagle is thought to be a Spanish-speaking group and is targeting mainly private and public entities in Colombia, but also expanding to Ecuador, Chile, and Spain.EcuadorBlind Eagle is thought to be a Spanish-speaking group and is targeting mainly private and public entities in Colombia, but also expanding to Ecuador, Chile, and Spain.Israel6. Iranian Hackers Launch Sophisticated Attacks Targeting Israel with PowerLess Backdoor – The Hacker NewsSpainBlind Eagle is thought to be a Spanish-speaking group and is targeting mainly private and public entities in Colombia, but also expanding to Ecuador, Chile, and Spain.