cyber.hendryadrian.com
Security News · darkowl.com

March Threat Intelligence Roundup Highlights MacStealer, Federal Agency Breach and More

· Original article ↗

Summary

A March roundup covers MacStealer targeting macOS credentials, exploitation of a Telerik flaw at a U.S. federal agency, a stolen-card data release, scam risks, malware targeting law firms, and cryptojacking of exposed Kubernetes systems.

Key points

  • MacStealer, sold as malware-as-a-service, targets macOS users through an unsigned DMG and can steal credentials from iCloud Keychain, browsers, crypto wallets, and other files.
  • Multiple threat groups exploited CVE-2019-18935, a Telerik UI for ASP.NET AJAX deserialization flaw, to access a U.S. federal civilian agency's IIS server from November 2022 to early January 2023.
  • BidenCash released a database of more than 2.1 million debit and credit cards; Cyble researchers said about 2.14 million entries were unique.
  • The roundup warns that the Silicon Valley Bank collapse created opportunities for cybercriminals to exploit public concern with scams.
  • GootLoader and SocGholish campaigns targeted six law firms, using compromised WordPress sites and watering-hole attacks, respectively.
  • A Dero cryptojacking operation targeted Kubernetes infrastructure with exposed APIs.

Article Details

Event Type
March threat-intelligence roundup covering malware, cyberattacks, data exposure, and cybersecurity-related scams.
Impact
The reported incidents include MacStealer stealing credentials and sensitive files from Mac users; exploitation of CVE-2019-18935 to breach a U.S. federal agency; a BidenCash release of more than 2.1 million debit and credit card records; malware campaigns targeting law firms; and cryptojacking targeting exposed Kubernetes infrastructure. The roundup also reports privacy concerns involving BetterHelp and increased cybercriminal activity following the Silicon Valley Bank collapse.

MITRE ATT&CK

T1189 · Drive-by CompromiseSocGholish is reported to use websites commonly visited by law firms for watering-hole attacks.T1190 · Exploit Public-Facing ApplicationThreat groups reportedly exploited a deserialization vulnerability in Progress Telerik UI for ASP.NET AJAX on a federal agency's IIS web server.T1555.001 · KeychainMacStealer is reported to steal passwords stored in the iCloud Keychain.

CVE

CVE-2019-18935The CVE that was exploited, CVE-2019-18935, is commonly exploited by threat actors and has been used by the group Praying Mantis.

Threat Actors

Praying MantisThe article says this group has used CVE-2019-18935.

Malware

Gootloader6. Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware – The Hacker NewsMacStealer1. New MacStealer macOS malware steals passwords from iCloud Keychain – Bleeping ComputerSocGholishGootLoader and FakeUpdates (SocGholish) are two malwares that have been used in separate threat campaigns to target 6 law firms this January and February.

Vendors

TelerikAn old security flaw in Progress Telerik was used by multiple threat groups to break into “federal civilian executive branch (FCEB) agency’s Microsoft Internet Information Services (IIS) web server.” The security flaw

Products

iCloud Keychain1. New MacStealer macOS malware steals passwords from iCloud Keychain – Bleeping ComputerInternet Information Services (IIS)multiple threat groups to break into “federal civilian executive branch (FCEB) agency’s Microsoft Internet Information Services (IIS) web server.” The security flaw exploited used a .NET “deserialization vulnerabilityKubernetes7. First-known Dero cryptojacking operation seen targeting Kubernetes – Bleeping ComputermacOS1. New MacStealer macOS malware steals passwords from iCloud Keychain – Bleeping ComputerTelerik UI for ASP.NET AJAXserver.” The security flaw exploited used a .NET “deserialization vulnerability affecting Progress Telerik UI for ASP.NET AJAX.” CISA, the FBI, and MS-ISAC (Multi-State Information Sharing and Analysis Center)

Related Articles