When the PREDATOR turns into the PREY

Hi my fellow malware enthusiast,

As you have seen in my previous post, the introduction is not my forte; let's see how this one goes... Please bear with me!

Did you know that ransomware was reported in more than 2,500 incidents in the first half of 2024 and the United States was the most-targeted country (I’m not surprised…) and guess what LockBit was responsible for 67% of all incidents (No wonder they were eager to catch them😂)

Yeah, I know hitting you with facts as soon as you start reading is kind of rough for an introduction.

Well, it’s already done, so you might as well continue reading!

Evil Video Exploit: A Hidden Threat in Telegram's Android App

Security researchers from ESET discovered a zero-day vulnerability called EvilVideo in Telegram's Android app. A threat actor named Ancryno was selling the exploit. This flaw allowed attackers to hide malware in video files. When users clicked on these fake videos, they were prompted to install a harmful file.

Telegram fixed this problem in version 10.14.5, released on July 11, 2024. The exploit was sold online in June 2024 and enabled attackers to spread malware through Telegram channels, groups, and chats.

Additionally, users with automatic media download enabled would get the malicious files just by opening the chat or channel where they were shared.

Void Banshee Exploits MHTML Vulnerability: Remote Code Execution Uncovered

Trend Micro Zero Day Initiative (ZDI) discovered a serious vulnerability, CVE-2024-38112, that allows hackers to remotely control computers by exploiting MHTML files.

This flaw was immediately reported to Microsoft as ZDI-CAN-24433. It has been used by a hacking group called Void Banshee, which targets regions in North America, Europe, and Southeast Asia to steal information and money.

Void Banshee used this vulnerability as part of an attack chain involving the Atlantida malware, which has been active and evolving since January 2024. The group’s attacks use internet shortcuts and Microsoft's protocol handlers to exploit the MHTML protocol, allowing them to run malicious code through a disabled Internet Explorer on Windows systems.

Trend Micro tracked these attacks in mid-May 2024, noting that Void Banshee consistently used similar methods to carry out their operations. The MHTML code execution vulnerability enabled the attackers to infect users and organizations with the Atlantida malware.

Mallox Ransomware Expands to Linux: New Tactics and Encryption Techniques

Mallox ransomware, also known as Fargo, TargetCompany, and Mawahelper, has been active since mid-2021 and started using a Ransomware-as-a-Service model in 2022.

Originally, Mallox used .NET-based, .EXE, or .DLL files to attack Windows systems through methods like phishing emails or exploiting exposed MS-SQL servers. Recently, Mallox has expanded to Linux systems. The attackers now use custom Python scripts to deliver the ransomware and steal information.

Once the ransomware is on a system, it encrypts the victim's files and adds a .locked extension to them.

When Hackers Become the Hacked: Medusa's Data Theft Exposed

Recently, Buguard's Dark Atlas Squad turned the tables on the Medusa Ransomware Group during an incident. Due to a security mistake by Medusa, Buguard infiltrated their cloud account and accessed the stolen data.

Medusa used a tool called Rclone to transfer data from their victims to their cloud storage. Rclone supports over 70 cloud services, with mega.nz and mega.io being popular choices for ransomware groups. In this case, Medusa used put.io, which was discovered through a configuration file they accidentally left behind. This slip-up allowed Buguard to gain valuable insight into Medusa's operations.

New APT Group TAG-100 Unveiled: Tools, Targets, and Tactics in Focus

A newly discovered hacking group, TAG-100, is targeting high-profile government and private organizations, mainly in the Asia-Pacific region. This group uses open-source tools and exploits internet-facing devices to gain access. TAG-100's targets include diplomatic entities, religious groups, and political organizations critical of the Chinese government.

The rise of open-source tools means that state-sponsored hackers can now outsource certain operations to less skilled groups or private contractors. This allows advanced groups to avoid using their own specialized tools, making their activities harder to detect and trace.

CloudSorcerer: New APT Targets Russian Government with Cloud-Based Tactics

A new APT group called CloudSorcerer has been found targeting Russian government agencies.

Discovered by Kaspersky in May 2024, CloudSorcerer uses cloud services like Microsoft Graph, Yandex Cloud, and Dropbox to hide its activities and manage its control. It also starts by using GitHub for its initial commands.

While it has some similarities to a past APT called CloudWizard, CloudSorcerer uses different malware, suggesting it's a new player using similar cloud-based methods.

✉️ Wrapping Up

In the world of malware, understanding is key. As we delve into these threats together, remember that knowledge and vigilance are our best allies.

If you find this newsletter helpful and know others who might benefit from it, I'd be grateful if you could pass it along. 🙏

Until next time, stay informed and keep your defenses sharp. Here’s to staying one step ahead

Thanks for reading!

@8erg