Weekly Cybersecurity Roundup: Scam Abuse, Router Backdoors and Port Disruption
Summary
SecurityWeek’s roundup covers OpenAI’s action against accounts tied to scams, confirmed Amgen cloud data theft, QuickFox and router compromises, and cyberattacks affecting a North Carolina port and other organizations.
Key points
- OpenAI banned coordinated ChatGPT accounts linked to a Cambodia-based scam operation that used the model to create fake personas, translate messages and forge documents.
- Amgen confirmed that data, including proprietary information and patient protected health information, was exfiltrated from third-party cloud environments; the investigation continues.
- A compromised QuickFox installer delivered the FDMTP implant to Windows systems. QuickFox removed the malicious components after Fortinet disclosed the compromise.
- Zbtlink cellular routers were found with the EndlessDoors backdoor, which phones home at boot and accepts unauthenticated root commands; VulnCheck advised treating affected devices as untrusted.
- DoubleCup ClickFix campaigns have delivered CountLoader and DeviceManager RATs; the latter resolves command-and-control infrastructure through Ethereum and Polygon smart contracts.
- North Carolina Ports said a cyberattack caused an outage at three port facilities. Gates reopened the next day with expected delays; whether sensitive data was taken remains unclear.
- IEH Corporation reported phishing-based unauthorized access to an employee’s Microsoft 365 mailbox. The actor could view emails and files, but the company found no evidence of successful data exfiltration.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering scam-network disruption, data theft, supply-chain malware, router backdoors, phishing, and attacks affecting financial firms and port operations.
- Impact
- OpenAI banned ChatGPT accounts linked to a Cambodia-based scam operation. Amgen reported that proprietary information and patient protected health information were exfiltrated from third-party cloud environments, with no reported impact to products, manufacturing, financial systems, or patient care. A compromised QuickFox VPN and game-accelerator app delivered malware to Windows systems; Zbtlink routers were reported to contain a backdoor capable of accepting unauthenticated root commands. North Carolina Ports experienced a systems-wide outage, with gates reopening the following day and possible data theft unresolved. An IEH Corporation employee mailbox was accessed through phishing, but the company found no evidence of successful data exfiltration. Hedge funds and private equity firms faced voice-phishing attempts; reported impact varied, with some investigations ongoing and no initial evidence of client data theft at Point72.
Malware
CountLoaderDoubleCup ClickFix loader delivers CountLoader and DeviceManager RATsDeviceManagerDoubleCup ClickFix loader delivers CountLoader and DeviceManager RATsENDLESSDOORSThe backdoor, dubbed EndlessDoors, requires no inbound access and any party controlling the C2 endpoints can issue shell commands or open interactive root shells.FDMTPQuickFox VPN supply chain attack drops FDMTP implant
Vendors
Products
ChatGPTOpenAI disrupts Cambodia scam network abusing ChatGPTmacOSCybersecurity firm Bynario hit the new cap after using ChatGPT to surface more than 50 macOS issues, including a privilege-escalation exploit it could not immediately report.Microsoft 365 Apps for Enterprisediscovered on August 4 that a threat actor had gained unauthorized access to an employee’s Microsoft 365 mailbox.Microsoft WindowsElectron installer that executed a JavaScript loader and ultimately installed the FDMTP implant on Windows systems.QuickFox VPNQuickFox VPN supply chain attack drops FDMTP implantSteamThe loader used process-based guardrails to avoid Steam users and prefer endpoints running development, database, or crypto tools before downloading the next stage.
Countries
Industries
AerospaceIEH Corporation, which provides high-reliability Hyperboloid connectors for defense, aerospace, and space applications, discovered on August 4 that a threat actor had gained unauthorized access to an employee’sData centersThe FCC is drafting rules that would block imports of new Chinese optical transceivers used inside data centers, aiming to reduce risks of data theft, malware, or service disruption in AI infrastructure.DefenseIEH Corporation, which provides high-reliability Hyperboloid connectors for defense, aerospace, and space applications, discovered on August 4 that a threat actor had gained unauthorized access to an employee’s