500,000 Victims Pummeled In Multi

The number of malware types deployed is "unprecedented," according to Cybereason.

An ongoing campaign from an unidentified threat actor has been deploying seven different kinds of malware — including ransomware — at once against an estimated 500,000 targets over the past couple of months to steal as much money as possible, according to new research from Cybereason.

The different kinds of malware deployed from just this one actor — which allows them to steal sensitive browser data, cookies, system information, two-factor authentication token information to bypass 2FA, and cryptocurrency from digital wallets — is “unprecedented,” Lior Rochberger, a security analyst at Cybereason, and Assaf Dahan, the head of threat research at Cybereason. The two released their findings on Wednesday.

“The combination of so many different types of malware exfiltrating so many different types of data can leave organizations unworkable,” Rochberger and Dahan write. “This threat is able to compromise system security, violate user privacy, harm machine performance, and cause great damage to individuals and corporations by stealing and spreading sensitive information, all before infecting them with ransomware.”

The attackers make their scheme work by exploiting code repository platform BitBucket to store and disperse the malware, according to Cybereason.

“[It’s] an ongoing trend with cybercriminals where they abuse legitimate online storage platforms like Github, Dropbox, Google Drive, and BitBucket to distribute commodity malware,” Rochberger and Dahan write in the blog post.

The campaign is relatively new — it popped up on Cybereason’s telemetry in December of last year, Dahan told CyberScoop. But the ultimate goal of the effort appears to be for money.

“The attackers aren’t satisfied with one payload, they want to use multiple to maximize their revenue,” the researchers write.

The attackers are running their scheme by targeting people scouring the internet for free commercial products, such as Adobe Photoshop. The threat actors will package them with multiple strains of malware, such as Azorult, which steals information and deletes its binary to erase traces of an infection.

“Legitimate applications are an easy, trusted way for attackers to gain entry and spread malware within an organization,” the researchers write.

Shortly after Azorult starts pilfering off information, Predator the Thief malware steals passwords from browsers, takes pictures and screenshots of the victims’ machines, and steals cryptocurrency out of digital wallets. The Thief malware can then connect with BitBucket to download more payloads, including STOP Ransomware, a Monero miner, and Vidar, which can steal web browser history, digital wallets, two-factor authentication tokens, and screenshots.

And although the researchers have ascertained what malware the attackers are using, Dahan told CyberScoop it’s not entirely clear who is behind the thievery.

“It’s hard to estimate who is the threat actor behind this campaign, because all the malware observed in the campaign fall under what we call ‘commodity’ malware. That means that almost anyone can buy them in the underground communities,” Dahan said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure