Cyber Intel Brief: April 28- May 4, 2022

Malware

Bumblebee: New Malware Loader Under Active Development

Key Points:

• Proofpoint observed phishing campaigns delivering a new downloader called Bumblebee, that has anti-analysis features and has been observed dropping Cobalt Strike, shellcode, Sliver, and Meterpreter.
• Threat actors have been observed delivering Bumblebee via links and attachments in mass phishing and email thread hijacking campaigns, as well as emails generated by submitting “Contact Us” forms on targets websites.
• Observation of this activity may be possible by monitoring for WMI command usage and DLL file activity in %AppData% directory.

Deepwatch Assessment:

Mitigation recommendations include incorporating the tactics, techniques, and procedures detailed by Proofpoint in your phishing awareness and simulation exercises and ensuring security protection systems such as Anti-Virus or End-point Detection and Response, are up to date and functioning properly.

---

Malware

A New BluStealer Loader Uses Direct Syscalls to Evade EDRs

Key Points:

• Minerva discovered a new version of a loader that is using syscalls to bypass EDRs solutions and once executed drops three files in the users %\Temp\% folder that ultimately loads and executes the BlueStealer malware.
• Persistence is achieved by creating registry keys that execute the malware each time the users logs on. BlueStealer is capable of harvesting credentials from numerous browsers and exfiltrating several file types from the users workstation.
• Observation of this activity may be possible by monitoring for the files and folders as detailed in the report as well as the creation of registry keys.

Deepwatch Assessment:

Recommendations include incorporating the technique of file masquerading through the use of icons in your phishing awareness and simulation exercises and ensuring security protection systems such as Anti-Virus or End-point Detection and Response (EDR), are up to date and functioning properly.

---

Threat Actors

The Lotus Panda is Awake, Again. Analysis of its Last Strike

Key Points:

• Cluster25, a cyber threat intelligence company, recently analyzed an incident involving the APT group known as Naikon (Lotus Panda), known for targeting Southeastern Asian countries to conduct long-term espionage operations.
• Cluster25’s analysis revealed the initial access (spear phishing) vector and two open-source tools (Viper and ARL) the threat actors used during the incident.
• Observation of this activity may be possible by monitoring for NI/EXE file activity in the %Temp% directory and suspended tasks involving svchost.exe.

Deepwatch Assessment:

Mitigation recommendations include incorporating the tactics, techniques, and procedures detailed by Cluster25 in your phishing awareness and simulation exercises and ensuring security protection systems such as Anti-Virus or End-point Detection and Response, are up to date and functioning properly.

---

Threat Actors

UNC3524: Eye Spy on Your Email

Key Points:

• Mandiant has discovered a threat actor they are tracking as UNC3524 that, at this time, are unable to link to any known threat group. The group primarily targets the mailboxes of executive teams and employees who work in the corporate development, mergers and acquisitions, or IT security staff.
• Initial access is unknown at this time and UNC3524 used a IoT botnet for C2 communications and deployed a new backdoor, dubbed QUIETEXIT, an SSH client-server application that is based on the open-source Dropbear SSH.
• Observation of this activity may be possible by monitoring for outbound SSH traffic over ports other than 22 and/or from unknown IP addresses and abnormal volume of network traffic originating from the management interfaces.

Deepwatch Assessment:

Recommendations include identifying all devices on the network that do not support monitoring tools and follow the vendor’s recommended harding guidelines and implementing network access controls to restrict or block outbound traffic from these devices.

---

Ransomware

REvil Ransomware Returns: New Malware Sample Confirms Gang is Back

Key Points:

• Bleeping Computer reports that multiple security researchers have discovered a new ransomware sample that is believed to be compiled from the original source code for REvil, indicating that the ransomware operation has reemerged.
• The new sample does not encrypt devices for, at this time, an unknown reason and the groups victim negotiation site uses the name “Sodinokibi.”
• Observation of this activity may be possible by monitoring for anomalous RDP attempts to enable it or login and TOR browser download and traffic activity.

Deepwatch Assessment:

To mitigate the risk of any ransomware operation, organizations are highly encouraged to follow the guidance and recommendations provided by CISA at their Stop Ransomware website. 

---

Ransomware

AvosLocker Ransomware Variant Abuses Driver File to Disable Anti-Virus, Scans for Log4shell

Key Points:

• Trend Micro analyzed sample of the AvosLocker ransomware that employs a legitimate driver (Avast anti-rootkit) to disable security tools and is able to scan endpoints that are vulnerable to the Log4J vulnerability using Nmap scripts.
• Initial access was determined to be a vulnerability in Zoho ManageEngine ADSelfService Plus (possibly CVE-2021-40539). Additionally, the threat actors  scanned for hosts that are vulnerable to Log4Shell,then using AnyDesk to transfer tools and the software deployment tool PDQ to deploy scripts to multiple endpoints. 
• Observation of this activity may be possible by monitoring for mshta.exe being used to execute remotely-hosted HTML applications and .aspx files being downloaded from remote IP addresses. 

Deepwatch Assessment:

To mitigate the risk of any ransomware operation, organizations are highly encouraged to follow the guidance and recommendations provided by CISA at their Stop Ransomware website. 

---

Ransomware

Conti and Hive Ransomware Operations: What We Learned From These Groups’ Victim Chats

Key Points:

• Cisco Talos’ recently analyzed Conti and Hive chat logs with victim organizations, the report offers “insights into how Conti and Hive choose their targets, negotiate with victims, operate internally, and much more.”
• Talos’ findings cover Conti and Hive communication methods, persuasion techniques, ransom negotiations, operational and targeting data, and more.
• Observation of this activity may be possible by monitoring for anomalous WMI/Nltest/ADFind command usage and unauthorized/anomalous usage of Psexec or Msiexec. 

Deepwatch Assessment:

To mitigate the risk of any ransomware operation, organizations are highly encouraged to follow the guidance and recommendations provided by CISA at their Stop Ransomware website. 

---

↑