January Cybersecurity Roundup: Malware Campaigns, Bridge Theft and ICS Advisories
Summary
A January roundup highlights reports on malware campaigns, the FBI's attribution of the $100 million Horizon Bridge theft to North Korean hackers, industrial control system advisories, and weaknesses reported in Threema's cryptographic protocols.
Key points
- Dark Pink, also known as Saaiwc, reportedly used phishing, malicious ISO files, USB spread, information stealers, and custom malware to target government and military organizations.
- Emotet reportedly added SMB-based lateral movement and credit-card theft targeting Chrome; a described delivery method used decoy Excel files in the Office Templates folder.
- The FBI attributed the $100 million Horizon Bridge cryptocurrency theft to North Korean groups Lazarus Group and APT38; some funds were frozen, while other funds were moved across networks and wallets.
- Threat actors reportedly used OneNote attachments in phishing emails to deliver VBS scripts and malware.
- A Dridex variant reportedly targeted macOS using a new infection method, while BackdoorDiplomacy was reported attacking Iranian government entities between July and December 2022.
- CISA issued industrial control system advisories affecting Siemens, GE Digital, and Contec products.
- Researchers reported cryptographic weaknesses in Threema; the company said the findings were largely theoretical and that prerequisite steps could have greater consequences.
Article Details
- Event Type
- Monthly roundup of cybersecurity news and threat intelligence, covering malware campaigns, cyber theft, attacks on government and industrial systems, and cryptographic weaknesses.
- Impact
- The articles summarized report confidential information theft, malware distribution and spread, credential and cryptocurrency theft, a $100 million cryptocurrency theft, attacks targeting Iranian government entities, security weaknesses in industrial control systems, and potential attacks against Threema users. The source does not provide a unified impact assessment for the roundup.
Threat Actors
APT38Identified by the FBI as involved in the $100 million Harmony Horizon Bridge cryptocurrency theft; described as a North Korean state-sponsored actor specializing in financial cyber operations.BackdoorDiplomacyThreat actor reported to have attacked Iranian government entities between July and December 2022 and to have targeted government entities since 2010.Dark PinkThreat actor reported to use custom malware, phishing, and USB-based malware spread; also named Saaiwc in the source.EvilCorpAssociated with a Dridex variant reported to use a new infection method targeting Mac OS systems.Lazarus GroupIdentified by the FBI as a North Korean hacker group responsible for the $100 million Harmony Horizon Bridge cryptocurrency theft.
Malware
CtealerOne attack chain deploys Cucky or Ctealer information stealers, and another uses a custom DLL side-loading procedure with a custom malware named KamiKakaBot.CuckyOne attack chain deploys Cucky or Ctealer information stealers, and another uses a custom DLL side-loading procedure with a custom malware named KamiKakaBot.Dridex6. Dridex Malware Now Attacking macOS Systems with Novel Infection Method – The Hacker NewsEmotet2. Emotet Malware Makes a Comeback with New Evasion Techniques – The Hacker NewsKamiKakaBotOne attack chain deploys Cucky or Ctealer information stealers, and another uses a custom DLL side-loading procedure with a custom malware named KamiKakaBot.
Vendors
Contec8. CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems – The Hacker NewsGE Digital8. CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems – The Hacker NewsInHand NetworksLess than a week earlier, CISA had released 12 other alerts impacting Sewio, InHand Networks, Sauter Controls, and Siemens.Sauter ControlsLess than a week earlier, CISA had released 12 other alerts impacting Sewio, InHand Networks, Sauter Controls, and Siemens.SewioLess than a week earlier, CISA had released 12 other alerts impacting Sewio, InHand Networks, Sauter Controls, and Siemens.Siemens8. CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems – The Hacker NewsThreema9. Expert Analysis Reveals Cryptographic Weaknesses in Threema Messaging App – The Hacker News
Products
Microsoft 365 Apps for EnterpriseMicrosoft OneNote is installed by default and included with Microsoft Office 2019 and Microsoft 365.Microsoft Office 2019Microsoft OneNote is installed by default and included with Microsoft Office 2019 and Microsoft 365.Microsoft OneNote5. Hackers Now Use Microsoft OneNote Attachments to Spread Malware – Bleeping ComputerThreema9. Expert Analysis Reveals Cryptographic Weaknesses in Threema Messaging App – The Hacker News
Industries
CryptocurrencyThe FBI confirms that North Korean hackers from Lazarus Group and APT38 stole $100 million in cryptocurrency from Harmony Horizon Bridge.Government7. Iranian Government Entities Under Attack by New Wave of Backdoor Diplomacy Attacks – The Hacker NewsIndustrial control systems8. CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems – The Hacker NewsMilitary1. New Dark Pink APT Group Targets Govt and Military with Custom Malware – Bleeping Computer