‘Vendetta’ hackers are posing as Taiwan's CDC in data

The hackers are part of a group known as Vendetta that has only surfaced in the last two months.

A mysterious hacking group has been posing as Taiwan’s top infection-disease official in an attempt to steal sensitive data from Taiwanese users, researchers said Monday.

The hackers sent meticulously written spearphishing emails to a select group of targets, which may have included Taiwan’s Centers for Disease Control employees, according to ElevenPaths, the cybersecurity unit of Spanish telecommunications firm Telefónica Group, which uncovered the activity.

It’s a reminder of the lengths to which hacking groups have gone to impersonate public health authorities and break into computer networks during the COVID-19 pandemic.

Over the course of a week in early May, the hackers sent emails to certain Taiwanese users urging them to get novel coronavirus tests. Attached to the email was a remote hacking tool capable of stealing login credentials and hijacking webcams.

“The type of tools and the targets selected indicate that they are looking for intelligence, mainly governmental,” Miguel Ángel de Castro Simón, threat intelligent analyst at ElevenPaths, told CyberScoop. It is unclear how successful the phishing was; de Castro Simón said he didn’t know.

The hackers are part of a group known as Vendetta that has only surfaced in the last two months. The group is adept at impersonating authorities in multiple languages. They have posed as agency officials in Australia, Austria and Romania in attempts to install remote hacking tools on victim machines, Chinese cybersecurity company Qihoo 360 said in a report in May. At least some of Vendetta’s hacking attempts have been to “steal targeted business intelligence,” according to Qihoo 360.

“This type of group does not carry out massive attacks, but [are] very selective, so the number [of victims] should not be too high,” de Castro Simón said when asked how many users in Taiwan may have been compromised.

The cyber-masquerading is a problem that health authorities around the world have had to contend with during the COVID-19 crisis. In the last three months, there have been reports of Iranian and South Korean hackers targeting the World Health Organization, Chinese spies trying to steal U.S. vaccine research and cybercriminals extorting health care companies responding to the virus.

In the U.S., the Department of Homeland Security’s cybersecurity division has allocated greater resources to protecting the U.S. Centers for Disease Control and Prevention from hacking.

The CDC is not the only health body in Taiwan that hackers have impersonated in recent weeks. Another, apparently unrelated campaign spoofed Taiwan’s Ministry of Health and Welfare in an attempt to install the LokiBot data-stealing malware on victim machines, according to a report from ISSDU, a Taiwanese cybersecurity company. It is unclear who is responsible for those attempted intrusions.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure