US Commission on International Religious Freedom reportedly hacked. Sophistication of NSO exploit on par with nation-state tooling. Conti ransomware actors exploit Log4Shell.

Summary

By the CyberWire staff

At a glance.

US Commission on International Religious Freedom reportedly hacked.
Sophistication of NSO exploit on par with nation-state tooling.
Conti ransomware actors exploit Log4Shell.
TinyNuke targets French users.

US Commission on International Religious Freedom reportedly hacked.

Avast has discovered "a new targeted attack against a small, lesser-known U.S. federal government commission associated with international rights." Avast doesn't name the affected entity, but the Record reports that it was the United States Commission on International Religious Freedom (USCIRF). Avast isn't sure what the attackers were after, but they note that the threat actor had significant access within the network:

"While we have no information on the impact of this attack or the actions taken by the attackers, based on our analysis of the files in question, we believe it’s reasonable to conclude that the attackers were able to intercept and possibly exfiltrate all local network traffic in this organization. This could include information exchanged with other US government agencies and other international governmental and nongovernmental organizations (NGOs) focused on international rights. We also have indications that the attackers could run code of their choosing in the operating system’s context on infected systems, giving them complete control. Taken altogether, this attack could have given total visibility of the network and complete control of a system and thus could be used as the first step in a multi-stage attack to penetrate this, or other networks more deeply."

Avast is releasing its research after notifying the affected entity and receiving no response:

"After initial communication directly to the affected organization, they would not respond, return communications or provide any information. The attempts to resolve this issue included repeated direct follow up outreach attempts to the organization. We also used other standard channels for reporting security issues directly to affected organizations and standard channels the United States Government has in place to receive reports like this. In these conversations and outreach we have received no follow up or information on whether the issues we reported have been resolved and no further information was shared with us."

Sophistication of NSO exploit on par with nation-state tooling.

Researchers at Google's Project Zero have analyzed an iOS exploit developed by spyware vendor NSO Group, concluding that, "Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we've ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states." The exploit, dubbed "FORCEDENTRY," takes advantage of an integer overflow vulnerability that was patched by Apple in September 2021. The exploit allows an attacker to infect a victim's phone by simply sending a text message. The researchers credit the University of Toronto's Citizen Lab for discovering the exploit after it was used to target a Saudi activist earlier this year.

Conti ransomware actors exploit Log4Shell.

Researchers at AdvIntel warn that Conti ransomware actors are exploiting Log4Shell, a critical vulnerability in Apache's Log4j logging library:

"On December 12, through deep visibility into adversarial collections, AdvIntel discovered that multiple Conti group members expressed interest in the exploitation of the vulnerability for the initial attack vector resulting in the scanning activity leveraging the publicly available Log4J2 exploit. This is the first time this vulnerability entered the radar of a major ransomware group. The current exploitation led to multiple use cases through which the Conti group tested the possibilities of utilizing the Log4J2 exploit. Most importantly, AdvIntel confirmed that the criminals pursued targeting specific vulnerable Log4J2 VMware vCenter for lateral movement directly from the compromised network resulting in vCenter access affecting US and European victim networks from the pre-existent Cobalt Strike sessions."

TinyNuke targets French users.

Proofpoint says the TinyNuke banking Trojan is targeting users in France via phishing emails that impersonate logistics and transportation companies:

"Proofpoint observed dozens of TinyNuke campaigns targeting French entities in 2018. After only observing a handful of TinyNuke campaigns in 2019 and 2020, Proofpoint observed TinyNuke reappear in January 2021 in one campaign distributing around 2,000 emails. Subsequent campaigns appeared in low volumes in May, June, and September. In November, Proofpoint identified multiple TinyNuke campaigns distributing around 2,500 messages and impacting hundreds of customers. In the most recent campaigns, the threat actor uses invoice-themed lures purporting to be logistics, transportation, or business services entities."

Selected Reading

Nation State Threat Group Targets Airline with Aclip Backdoor (Security Intelligence) An attack on an Asian airline was uncovered, likely compromised by a state-sponsored adversary using a new backdoor that utilizes Slack. IBM Security X-Force experts share the findings from their research.

HANCITOR DOC drops via CLIPBOARD (McAfee Blogs) By Sriram P & Lakshya Mathur Hancitor, a loader that provides Malware as a Service, has been observed distributing malware such as FickerStealer,

Driver-Based Attacks: Past and Present | Rapid7 Blog (Rapid7) In our analysis of CVE-2021-21551, we found that Dell’s update didn’t fix the write-what-where condition but only limited access to administrative users.

The Continued Evolution of Abcbot (Cado Security | Cloud Native Digital Forensics) A new version of a malicious shell script targeting insecure cloud instances running under Cloud Service Providers such as Tencent, Baidu and Alibaba Cloud has recently been discovered. The shell script prepares the target host for additional compromise over SSH, kills off processes from competing threat actors and persists itself, before downloading an additional ELF executable used to connect to a botnet as part of a campaign dubbed by 360Netlab as “Abcbot”.

Malicious packages in npm enable theft of Discord tokens, other data (JFrog) Software supply chain security threat: automated scanning of open-source packages in the npm registry uncovered malware that puts sensitive data and devices at risk.

StealthLoader Malware Leveraging Log4Shell (Check Point Research) Introduction While monitoring the exploit activity, Check Point Research detected many attacks involving the mining of cryptocurrencies. While most miners detected are Linux based, Check Point researchers recently discovered a Win32 executable malware identified as StealthLoader. This .NET-based malware surfaced right after the Log4j vulnerability was discovered. The StealthLoader Trojan performs various evasion techniques in... Click to Read More

Phorpiex botnet is back with a new Twizt: Hijacking Hundreds of crypto transactions (Check Point Research) Research by: Alexey Bukhteyev Check Point Research (CPR) spotted the resurgence of Phorpiex, an old threat known for its sextortion spam campaigns, crypto-jacking, cryptocurrency clipping and ransomware spread The new variant “Twizt” enables the botnet to operate successfully without active C&C servers Phorpiex crypto-clipper supports more than 30 wallets for different blockchains In one year,... Click to Read More

USB Over Ethernet | Multiple Vulnerabilities in AWS and Other Major Cloud Services (SentinelOne) 25 CVEs and counting: SentinelLabs' latest research reveals millions of cloud users are exposed to privilege escalations from bugs in shared driver software

Disrupting the Glupteba operation (Google) Glupteba is a Windows malware monetizing through crypto currency mining, proxying malicious traffic, and stealing user cookies/credentials. We coordinated a clean up of Glupteba with key industry partners in an effort to curb this operation.

“Offshore” Shinjiru Provides Bulletproof Services to Cyberattackers (RiskIQ) Bulletproof hosting (BPH) is a collection of service offerings catering to internet-based criminal activity. Shinjiru is another example frequently appearing in threat infrastructure. The Malaysian hosting company shields its customers and their web content and servers from takedown requests, acting as a safe harbor for questionable or illicit activity.

The dirty dozen of Latin America: From Amavaldo to Zumanek | WeLiveSecurity (WeLiveSecurity) ESET researchers wrap up their series of articles dedicated to demystifying banking trojans that target Latin America.