The month of August has seen the rise of government-sponsored threat actors and versatile phishing campaigns on the cybersecurity front. Discover more about:
- the China-stated sponsored groups RedHotel and Flax Typhoon;
- new threat targeting Bulgaria, China, Vietnam;
- two large-scale phishing campaigns – one targeting Zimbra users and another exploiting QR codes.
It’s also essential to highlight a recent report that disclosed that DDoS attacks have been on the rise – increasing by 40% in the last six months.
There have also been multiple updates on the cybersecurity justice front. Find out more in AMATAS’s August newsletter about:
- Quakbot’s and 16shop’s takedowns;
- CISA’s Remote Monitoring and Management (RMM) Cyber Defense Plan;
- the arrest of 14 suspected cybercriminals and +20.6K identified “suspicious” cyber networks in the latest INTERPROL and AFRIPOL operation.
Let’s take a look at some of the highlights of the past month.
Cybercrime Breaking News
Chinese state-sponsored group, RedHotel, has been targeting various sectors (e.g. aerospace, government, telecommunications, etc.) across 17 countries in Asia, Europe, and North America. Researchers pinpoint that the group has been active since 2021.
Cisco Talos discloses that a new threat actor has been targeting Bulgaria, China, Vietnam, and other countries. Active as of June 2023, the actor is said to be of Vietnamese origin, and targeting organizations using a customized Yashma ransomware.
Microsoft identifies how a China-sponsored group, Flax Typhoon, has been targeting Taiwanese organizations. The malicious activities are said to be in order to carry out espionage campaigns.
Cybersecurity researchers identify Cloudzy – an often-used service provider for ransomware, government-sponsored APT, and other cybercriminal attacks. Cloudzy is pinpointed to be operating out of Iran.
Hacktivists Mysterious Team Bangladesh, active since June 2022, has carried out over 750 DDoS attacks and defaced 78 websites, discloses a cybersecurity report. The group has targeted mainly government, financial, and transportation organizations in India.
The Monti group has been targeting legal and government organizations via a new Linux-based ransomware.
The Cisco Talos team warns about the rising threat of SapphireStealer, an open-source information stealer malware.
A new mass-spreading phishing campaign, active since April 2023, is targeting Zimbra Collaboration users. Zimbra is an alternative to enterprise email solutions. The phishing campaign targets users (like small and medium businesses; and government organizations) in mainly Poland, Ecuador, and Italy.
A large QR code phishing campaign has been targeting various industries, including energy, manufacturing, insurance, technology, and finance services, aiming to attain Microsoft credentials.
Cybersecurity researchers discovered a phishing campaign that is targeting Facebook business accounts using malware NodeStealer.
AnonFiles shuts down due to “extreme volumes” of users abusing the file hosting platform.
Cybersecurity Justice
Quakbot – a most prolific botnet, active since 2008 – has been taken down in a joint operation, conducted by the FBI, the U.S. Justice Department, and agencies in France, Germany, the Netherlands, the United Kingdom, Romania, and Latvia.
Interpol takes down the “notorious” ‘phishing-as-a-service’ (PaaS) platform, ’16shop’, which is said to have compromised over 70,000 users in 43 countries.
In a joint partnership with the Joint Cyber Defense Collaborative (JCDC), CISA released the Remote Monitoring and Management (RMM) Cyber Defense Plan. This “first proactive Plan” aims to address the risks the government and private sector face from exploited RMM software.
Coordinated operation by INTERPOL and AFRIPOL arrests 14 suspected cybercriminals. The operation also identified +20.6K “suspicious” cyber networks, linked with financial losses of over $40 million.
Court convicts two teenagers for their participation in the Lapsus$ gang. Subsequently, one of which is believed to be behind the Uber, Nvidia, and Rockstar Games hacks.
Married couple plead guilty to money laundering conspiracies, after hacking Bitfinex and stealing around 120,000 bitcoin. They were arrested in February 2022.
FinTech Updates
Millions may have been stolen from cryptocurrency platforms as hackers exploit a vulnerability in the Web3 programming language, Vyper. Affected by the vulnerability are the DeFi platform Curve Finance, Ellipsis, Alchemix, and MetronomeDAO.
DeFI platforms (Exactly Protocol and Harbor Protocol) deal with cybersecurity attacks. Cryptocurrency worth millions may have been stolen by malicious actors.
Cybersecurity News Across The Globe
- Italy’s cybersecurity agency revealed that at the beginning of the month, denial-of-service (DDoS) attacks targeted the websites of at least five banks, businesses, and government agencies. A pro-Russian hacking group claims they’re behind the attacks.
- “Complex cyber-attack” targeting the UK’s Electoral Commission exposed the personal data of millions of British voters. The attack was identified in October 2022 and was believed to have first accessed the Commission’s systems in August 2021.
- The Metropolitan Police may have fallen victim to a suspected data breach.
- The German Federal Bar (BRAK) Association is investigating a cyberattack, believed to have been perpetrated within its Brussels office, on August 2nd.
- A cyberattack on Montreal’s electricity organization (Commission des services electriques de Montréal (CSEM)) is said to have been carried out by LockBit.
- Cybersecurity company identifies malware and infrastructure (from suspected Chinese-based actors) targeting Southeast Asia’s gambling sector.
- An attempted cyberattack targets Gemini North observatory, located in Hawai’i.
These Formal Trainings Will Help YOU Secure Your Future
Delve into the intersection of Generative AI and cybersecurity and discover how these transformative technologies can fortify technical and management aspects of cybersecurity with AMATAS Chief Strategy Officer Boris Goncharov during the sessions on Leveraging Generative AI in Cybersecurity
Discover more about 3T23 Cybersecurity Learning Opportunities
AMATAS News
AMATAS is a CREST Penetration Service Provider
We are above and beyond excited to share AMATAS’ debut as a CREST Penetration Service Provider. Read details about CREST Certification value and AMATAS holistic approach to attacks in our latest publication 👉 The Power of CREST-Certified Penetration Testing
“CREST accreditation is a testament to our unwavering commitment to delivering world-class penetration testing services. This accomplishment underlines our dedication to maintaining the highest cyber security practice and ethical conduct standards. As we continue to navigate an increasingly digital world loaded with ever-evolving threats, our customers can now have added assurance in partnering with a company that meets the rigorous standards set by CREST. Achieving this accreditation is not just a milestone for our team but a promise of quality and trustworthiness to our valued customers”, shared Boris Goncharov, AMATAS Chief Strategy Officer.
SERVICE MANAGEMENT SUMMIT Invitation
AMATAS Chief Strategy Officer Boris Goncharov will be a Keynote speaker discussing The Future of Cybersecurity during the Service Management Summit on the 28th of September, 2023. Join this event happening in Bellevue, USA. Get the chance to learn from and network with top industry leaders.
This month, we’re also focusing on AI, penetration testing, and the most common (and dangerous) cyberattacks. Read on for our updates on:
⭐ The new reality of ChatGPT – does it hide an unexpected threat to cyber security?
⭐ The Pros and Cons of Manual and Automated Penetration Testing
⭐ The Most Common Cyber Attacks | Part 1⭐ The Most Common Cyber Attacks | Part 2
AMATAS will continue to monitor this space and deliver salient information regularly.
Stay tuned for our next report, and if you are interested in any of our privacy and cybersecurity services, please do reach out through our website www.amatas.com or by e-mailing office@amatas.com.
As always – be vigilant, stay alert, and think twice.
