Feds investigate group 764, Russians hack hackers, AWS PQC migration

Summary

Cyber Security Headlines - Detailed Summary
Hosted by CISO Series
Episode: Feds Investigate Group 764, Russians Hack Hackers, AWS PQC Migration
Release Date: December 6, 2024

---

1. Feds Investigate Sextortion Group 764

In this segment, Rich Stroffolino discusses recent federal investigations into a child sextortion group identified as Group 764. According to a joint intelligence note from the Joint Regional Intelligence Center and the Central California Intelligence Center, Group 764 employs traditional cybercrime techniques such as SIM swapping, social engineering, and IP grabbing to carry out their operations.

Key Points:

• Operational Tactics: The group utilizes a Telegram channel, numbered 6996, which is part of a larger collective known as the COM. This channel provides resources and tools for committing fraud, grooming minors for self-harm, and fostering a troubling online culture.
• Deceptive Practices: Notably, Group 764 operates a fake Telegram channel that ostensibly offers suicide prevention support. However, this channel is a façade used to dox and extort victims.

Notable Quote:
Rich Stroffolino highlights the gravity of the situation:
"Group 764's manipulation of support channels to facilitate extortion illustrates the sophisticated and deceptive nature of modern cybercriminal operations." [02:15]

2. Russian Hackers Exploit Other Cybercriminals' Infrastructure

The episode delves into a report from Lumen's Black Lotus Labs, which reveals that the Russian cyber espionage group Turla has been hijacking the infrastructure of the Pakistani group Storm 0156 to launch their own cyberattacks.

Key Points:

• Infrastructure Hijacking: Researchers observed that Turla began interacting with IP addresses linked to Storm 0156 via a Command and Control (C2) server on an Indian government network.
• Escalation of Tactics: Over time, Turla not only used Storm 0156's servers to deploy backdoors and malware but also gained direct access to their network and tools. This access was then leveraged to target Afghan government agencies.
• Historical Context: This behavior mirrors Turla's past activities, such as the 2019 NSA advisory where Turla hijacked infrastructure from the Iran-backed Group OilRig.

Notable Quote:
A Microsoft researcher involved in the report notes,
"Turla's ability to infiltrate and repurpose other hacker groups' infrastructure demonstrates their relentless pursuit of advanced espionage capabilities." [04:40]

3. Amazon's Post-Quantum Cryptography (PQC) Migration Plan

Amazon Web Services (AWS) has announced its strategy for integrating Post-Quantum Cryptography into its services, addressing the impending challenges posed by quantum computing to current encryption standards.

Key Points:

• Rollout Strategy: AWS will enable some PQC features by default for all customers, while others will require manual activation. Importantly, AWS will not re-encrypt existing data secured with 256-bit symmetric cryptography.
• Initial PQC Implementations: The first phase involves negotiating shared symmetric keys with public endpoints and adding PQC mitigations through root-of-trust key pairs.
• Open Source Deployment: AWS has incorporated PQC into its AWS LC cryptographic library, used in their TLS implementation.
• Recommendations for Organizations: The AWS blog post provides guidance for organizations embarking on their PQC migration, detailed further in the show notes.

Notable Quote:
Rich emphasizes the significance of this transition:
"AWS's proactive approach to PQC ensures that organizations are prepared for the quantum era, safeguarding their data against future threats." [05:30]

4. Chinese Group Linked to Long-Term Intrusion

Symantec researchers have uncovered a prolonged cyberattack carried out by a Chinese-linked threat actor against an unnamed U.S. organization. The attacks have been ongoing since at least April 11, 2024, and possibly longer.

Key Points:

• Attack Methodology: The threat actors employed a DLL sideloading technique, similar to that used in the Crimson Palace espionage campaign discovered in September.
• Objectives: Their primary goals included credential theft and targeted access to Exchange servers.
• Historical Ties: The victim organization had previously been attacked by the Chinese-based group Daggerfly in 2023, indicating a persistent targeting pattern.

Notable Quote:
A Symantec researcher states,
"The continuity and sophistication of these attacks underline the persistent threat posed by state-linked actors aiming to infiltrate critical infrastructure." [06:50]

5. Cisco Switches Vulnerable to Bootloader Exploit

A significant security flaw has been identified in over 100 models of Cisco switches across their MDS, Nexus, and UCS fabric interconnect lines. This vulnerability allows attackers to bypass the bootloader verification process and load malicious software.

Key Points:

• Nature of the Flaw: The exploit does not require authentication but necessitates physical access to the switches.
• Mitigation Measures: Cisco has released several NX-OS updates to patch the vulnerability, with plans to deploy these updates to all affected devices by the end of the month, excluding one discontinued Nexus model.
• Security Recommendations: Cisco advises organizations to prevent unauthorized physical access to their switches as no other mitigations are currently available.

Notable Quote:
Rich underscores the importance of swift action:
"Organizations must prioritize applying these NX-OS updates to secure their network infrastructure against potential physical and software-based attacks." [07:20]

6. WeChat Exploit Targets Uyghurs and Tibetan Minorities

Trend Micro researchers have identified a Chinese-linked threat group, Earth Minotaur, utilizing the Moonshine exploit kit on WeChat and Chromium-based browsers to deploy the Dark Nimbus backdoor on Android and Windows devices.

Key Points:

• Target Demographics: The attacks specifically target Tibetan and Uyghur ethnic minorities in China.
• Attack Vectors: The group uses messaging lures related to government announcements, embedding malicious links to install the Dark Nimbus backdoor.
• Social Engineering Tactics: By masquerading as different characters in chats, the attackers enhance the success rate of their social engineering efforts.

Notable Quote:
A Trend Micro analyst comments,
"The meticulous crafting of these lures demonstrates a deep understanding of the targeted communities, making the attacks particularly insidious." [05:55]

7. Russian Spyware Deployed on Detainee Phones

In a concerning development, Russian authorities have been found installing spyware on the phones of detainees. Russian programmer Kirill Perubets experienced unusual activity on his phone following his release from government custody.

Key Points:

• Spyware Details: The Trojanized application "Cube Call Recorder" was installed on Perubets' device, exhibiting functionalities similar to the Monocle spyware. It can access location data, read and send SMS messages, record screens, and answer phone calls.
• Forcible Informant Recruitment: Authorities coerced Perubets into becoming an informant on Ukrainian aid activities, employing physical abuse during his detention.
• Technical Analysis: Citizen Lab's investigation revealed code similarities to previously documented spyware, confirming the malicious nature of the application.

Notable Quote:
Rich highlights the human cost, stating,
"The deployment of such invasive spyware not only breaches digital privacy but also serves as a tool for physical coercion and control." [06:35]

8. Generative AI Enhances Financial Fraud

The FBI's Internet Crime Complaint Center has issued an alert about the increasing use of generative AI tools in large-scale financial fraud schemes. These advanced tools enable fraudsters to execute more sophisticated and believable scams.

Key Points:

• AI Utilization: Tools like ChatGPT facilitate language translation for romance and investment scams, while image generation software creates authentic-looking social media profiles and supporting evidence.
• Deepfake Technology: Deepfakes are increasingly used to bypass visual verification checks or on video calls, adding another layer of deception.
• Protective Measures: The FBI recommends using a secret word or phrase to verify identities with friends and family to mitigate these risks.

Notable Quote:
Rich advises listeners,
"As AI technologies evolve, so do the tactics of fraudsters. It's imperative to adopt simple yet effective verification methods to protect against these sophisticated scams." [07:55]

---

Conclusion

This episode of Cyber Security Headlines provides a comprehensive overview of the latest threats and developments in the cybersecurity landscape. From the intricate operations of cybercriminal groups to the proactive measures companies like AWS are taking against future threats, the discussion underscores the dynamic and evolving nature of cybersecurity challenges. Listeners are encouraged to stay informed and vigilant, implementing recommended security practices to safeguard their organizations and personal information.

For more in-depth stories and updates, visit CISOseries.com.

Transcript

[A]

From the CISO series, it's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Friday, December 6, 2024. I'm Rich Stroffolino. Feds find cybercriminal tools used by sextortion group According to a joint intelligence note from the Joint Regional Intelligence center and the Central California Intelligence center seen by Cyberscoop the Child Sextortion Group 764 uses traditional cybercrime techniques in its operation, including SIM swapping, social engineering and IP grabbing. Much of this comes from a telegram channel operated by the group 6996, which associates with a wider collective called the COM. This documentation offers resources and tools for committing fraud, grooming minors for self harm and forming a culture. Further, FBI notes seen by Cyberscoop show Group 764 operates a fake telegram channel that offers suicide prevention support, but ultimately is used to dox and extort victims. Russian hackers hack hackers in no honor among thieves News A new report from Lumen's Black Lotus Labs details how the Russian cyber espionage group Turla used the infrastructure of the Pakistani link group storm 0156 launch their own attacks. Researchers have been observing operations by storm 0156, finding a C2 server on an Indian government network. This server began interacting with three IP addresses known to be linked to Turla. Further research shows Turla used the Pakistani group's infrastructure since 2022, using the servers to launch various backdoors and other malware. Eventually, Turla got more ambitious, moving laterally into Storm 0156's network and gaining direct access to their data and tooling. Researchers at Microsoft contributed to the report said Turla used this access to target Afghan government agencies. This isn't a new tactic for turla. Back in 2019, the NSA put out an advisory that it hijacked infrastructure by the Iran backed Group oil rig to carry out attacks. Amazon's post Quantum Migration Plan AWS published a blog post with an overview of how it will roll out support for Post Quantum Cryptography or pqc. Some features will be enabled by default for all customers, while others will be up to customers to activate. The company won't re encrypt data at rest already encrypted using 256 bit symmetric cryptography, but its first PQC rollout will be with negotiating shared symmetric keys with public endpoints. It will also add PQC mitigations when offering the ability to create key pairs that will act as a root of trust. AWS has also deployed PQC to its open source AWS LC cryptographic library, which it uses in its TLS implementation. The blog post also contains recommendations for organizations starting their own PQC migration, so look for the details in our show Notes Chinese group linked to another long term intrusion Researchers at Symantec report that a Chinese linked threat actor carried out a long term attack against an unnamed US organization operating since at least April 11, 2024, likely a lot longer. The attacks used a DLL sideloading attack showing similarities to the larger Crimson palace espionage campaign sofas discovered back in September. The threat actors used their access for credential theft and targeted access around exchange servers. While we don't know the name of the victim, researchers said it previously suffered an attack linked back to the Chinese based group daggerfly in in 2023 and now thanks to today's episode sponsor Vanta as third party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta questionnaire Automation, security and compliance teams can complete security reviews up to five times faster, giving you time back to focus on running your security and compliance programs. Over 8,000 global companies like ZoomInfo, smart recruiters and NOIBU use Vanta to save time on security reviews. Visit vanta.com to learn more about Questionnaire Automation. That's V A N T a dot com Cisco switches hit with bootloader vulnerability the flaw impacts over 100 device models across Cisco's MDS, Nexus and UCS fabric interconnect lines, allowing an attacker to bypass the bootloader verification process and load software. The flaw doesn't require any authentication, but does require physical access to the switches. Cisco released several nxos updates to patch the flaws and will roll out the updates to all devices by the end of the month, excluding one discontinued Nexus model. It did caution that no mitigations for this flaw will be available other than preventing physical access to the switches. WeChat bug used to target Uighurs Researchers at Trend Micro discovered a Chinese link threat group called Earth Minotaur that uses the Moonshine exploit kit on WeChat and chromium based browsers to install the Dark Nimbus backdoor on Android and Windows devices. Researchers described Dark Nimbus as a comprehensive Android surveillance tool. The attackers used messaging lures tied to government announcements with embedded malicious links to get Moonshine on devices disguising themselves as different characters on chats to increase the success of their social engineering attacks. Based on the lures used in the messages. These attacks target Tibetan and Uyghur ethnic minorities in China. Russians put spyware on detainee phone Russian programmer Kirill Perubets spent two weeks in government custody. Soon after his release, he noticed unusual activity, including atypical notifications after contacting a Russian legal assistance group. Citizen lab analyzed the device and found authorities loaded the Trojanized application Cube call recorder on his phone while in custody. Code samples show similarities to the Monocle spyware Lookout Mobile Security documented back in 2019. The app can access location data, read and send SMS messages, record the screen and answer phone calls. Per Ubet said authorities pressured him into becoming an informant on Ukrainian aid activity and physically beat him while in custody. Gen AI boosting financial fraud A new alert from the FBI's Internet Crime Complaint center details how threat actors are using generative AI tools for fraud on a larger scale and with more unbelief ability. This includes using tools like ChatGPT to assist with language translation for romance and investment scams, enabling faster and more elaborate lures. Image generation tools allow for believable social media profile photos and other supporting evidence used in financial fraud schemes. And deepfakes are seeing increased usage either for short audio only voice clips, bypassing visual verification checks, or just on video calls. Not surprisingly, the FBI recommended creating a secret word or phrase to verify your identity with friends and family. Do you have your AI security perfectly thought out? Congratulations, you're the only one. For the rest of us mortals, you might want to check out our latest Super Cyber Friday discussion all about hacking the AI supply chain. It's one thing to have a handle on what information is going into models you're directly using in your organization, but it's another thing to understand and secure the full AI chain reaching into all your SaaS apps. It starts at 1pm Eastern, 10am Pacific. Head on over to our events [e-mail] to register. Reporting for the CISO series, I'm Rich Droffalino reminding you to have a super sparkly day.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the headlines.