Volt Typhoon's new botnet, China APT hits Tibet, DoD leaker sentenced

Summary

Cyber Security Headlines – November 14, 2024

Hosted by Rich Stroffolino from the CISO Series

---

1. Volt Typhoon Rebuilding Botnet

Overview:
In early 2024, the U.S. government successfully disrupted the Volt Typhoon botnet, a notorious threat actor suspected of having ties to the Chinese government. This botnet primarily exploited unpatched Cisco, Fortinet, and Netgear devices to carry out malicious activities. Recent developments indicate that Volt Typhoon is in the process of constructing a new botnet.

Key Points:

• Reconstruction Efforts: Researchers at Security Scorecards have identified a new cluster associated with Volt Typhoon, which is covertly routing traffic through compromised Netgear Pro, Safe Microtik, and Cisco RV320 devices.
• Tactics and Infrastructure: The group appears to be utilizing the same core infrastructure and techniques previously employed by Volt Typhoon, signaling continuity in their operations.

Notable Quote:

"This appears to be using the same core infrastructure and techniques previously seen from Volt Typhoon." – Rich Stroffolino [00:00]

---

2. Chinese APT Targets Tibetan Media

Overview:
A cyber espionage campaign targeting Tibetan media has been attributed to the Chinalink Group, also known as Tag 112. This subgroup likely operates under the larger Evasive Panda threat actor umbrella.

Key Points:

• Attack Vectors: The campaign utilized Cobalt Strike to compromise the websites of the Tibet Post and GiuD Med Tantric University, exploiting their Jumla CMS.
• Operational Ties: Tag 112 shares similar tactics with Evasive Panda but lacks the sophistication for deploying custom malware. Notably, Evasive Panda has previously compromised the Tibet Post in other attacks.

Notable Quote:

"Tag 112 may be a subgroup of the channeling threat actor Evasive Panda, as it shows similar tactics." – Rich Stroffolino [00:00]

---

3. DoD Leaker Sentenced

Overview:
Former Massachusetts Air National Guardsman, Jack Teixeira, has been sentenced to 15 years in prison for leaking classified Department of Defense information.

Key Points:

• Nature of the Leaks: Teixeira disseminated classified documents via Discord in 2022, which included sensitive details such as troop movements and equipment information provided to Ukraine.
• Legal Proceedings: Discovered in March 2023, Teixeira pleaded guilty to six counts related to the leak.
• Plea Deal and Response: As part of a plea agreement in March 2024, Bitdefender released the Shrink Locker Decryptor to aid victims in recovering from attacks.

Notable Quote:

"Court documents show Teixeira shared classified documents on Discord sometime in 2022, including troop movements and information on equipment provided to Ukraine." – Rich Stroffolino [00:00]

---

4. Shrink Locker Decryptor Released

Overview:
Bitdefender has launched the Shrink Locker Decryptor, a tool designed to help victims recover quickly from ransomware attacks involving the Shrink Locker variant.

Key Points:

• Ransomware Details: Shrink Locker, first documented by Kaspersky in May 2024, is written in VBScript and leverages Windows' BitLocker utility to encrypt files. It primarily targets regions like Indonesia, Jordan, and Mexico.
• Attack Mechanism: The ransomware employs group policy objects and scheduled tasks to encrypt multiple systems within a network swiftly, often within 10 minutes per device.
• Preventative Measures: Kaspersky recommends proactive monitoring of specific Windows event logs and configuring BitLocker to store recovery information in Active Directory domain services to mitigate similar threats.

Notable Quote:

"Shrink Locker uses group policy objects and scheduled tasks to encrypt multiple systems within a network in as little as 10 minutes per device." – Rich Stroffolino [00:00]

---

5. Hamas-Affiliated Group Targets the Middle East

Overview:
Apt Wired, believed to be part of the Gaza cyber gang, has been actively conducting phishing campaigns against Israeli organizations and other Middle Eastern entities since August 2018.

Key Points:

• Campaign Tactics: The group utilizes an updated version of the Same Coin wiper, enhancing its capabilities to not only encrypt data but also overwrite files with random bytes. Additionally, it alters the system's background to display the name of Hamas' military wing.
• Geographical Targets: Beyond Israel, the attacks have extended to the Palestinian Authority, Jordan, Iraq, Saudi Arabia, and Egypt.
• Toolset Versatility: Check Point researchers highlight the group's ability to iterate across multiple campaigns, showcasing a flexible infiltration and malware toolkit.

Notable Quote:

"These phishing attacks use a new version of the Same Coin wiper, which adds the ability to encrypt data on systems as well as overwriting files with random bytes." – Rich Stroffolino [00:00]

---

6. Amazon Leaker Claims to Be Ethical Hacker

Overview:
An individual operating under the alias "Nameless" has purportedly leaked 2.8 million lines of Amazon employee data on a dark web forum, claiming to act as an ethical hacker.

Key Points:

• Data Compromise: The leaked information includes names, organizational roles, contact details, and department assignments from various companies such as Lenovo, Delta, HSBC, and Charles Schwab, obtained through the MoveIt file transfer exploitation.
• Motivation: Nameless asserts that the data was scraped using legitimate credentials and only publicly available information. The intent behind the leak is to raise awareness about the necessity of encrypting Personally Identifiable Information (PII) within organizations.
• Future Threats: Nameless has indicated that additional data will be released in the coming days, heightening concerns over potential social engineering attacks leveraging the exposed information.

Notable Quote:

"They said they published the data to raise awareness of the need to encrypt PII at these organizations and not to hide behind blaming third parties for leaked data." – Rich Stroffolino [00:00]

---

7. Sheboygan Hit by Ransomware Attack

Overview:
The city of Sheboygan, Wisconsin, has been experiencing network outages since late October, which have been attributed to a ransomware attack demanding a ransom.

Key Points:

• Impact of the Attack: Officials confirmed unauthorized access to the city's network, leading to temporary network outages. Emergency services faced limited interruptions, while cloud-based services remained operational for city employees.
• Response Strategy: The city is collaborating closely with law enforcement and adhering to their guidance as part of the response to the attack.
• Status of the Attack: No group has claimed responsibility, and city officials have been reserved in disclosing detailed information about the incident.

Notable Quote:

"Officials also confirmed that the city received a ransom demand, saying, 'We are cooperating fully with law enforcement and incorporating their guidance into our response.'" – Rich Stroffolino [00:00]

---

8. D-Link NAS Devices Under Attack

Overview:
A critical vulnerability has been discovered in D-Link NAS devices, specifically the DNS320, DNS325, and DNS340L models, which are now considered end-of-life.

Key Points:

• Vulnerability Details: Researchers at NetSecFish identified a command injection flaw that allows unauthorized attackers to execute shell commands via GET requests. This vulnerability has been actively exploited since November 8.
• Scope of Impact: Over 41,000 unique IP addresses corresponding to vulnerable devices have been found online.
• Manufacturer's Stance: D-Link has declared that it has no plans to release a patch for these end-of-life models.
• Mitigation Recommendations: Customers are advised to either replace the affected devices or, at a minimum, restrict them from having open Internet access to prevent exploitation.

Notable Quote:

"D-Link advises customers to replace the devices or at the very least, restrict them from open Internet access." – Rich Stroffolino [00:00]

---

Conclusion:

This episode of Cybersecurity Headlines provided a comprehensive overview of the latest threats and developments in the cybersecurity landscape. From the resurgence of Volt Typhoon's botnet activities to the sentencing of a DoD leaker and the discovery of critical vulnerabilities in widely-used devices, each segment underscored the evolving challenges faced by organizations and individuals alike. Additionally, the discussions highlighted the imperative for proactive security measures, continuous monitoring, and robust incident response strategies to mitigate emerging threats.

For a deeper dive into any of these stories, visit CISOseries.com.

---

Reporting for the CISO Series, I'm Rich Stroffolino, reminding you to have a super sparkly day.

Transcript

[Rich Stroffolino]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Thursday, November 14, 2024. I'm Rich Stroffolino. Volt Typhoon rebuilding botnet in early 2024, the US government announced it had disrupted the botnet used by Volt Typhoon, a threat actor with suspected links to the Chinese government. This botnet largely used unpatched Cisco, Fortinet and Netgear devices. We're now seeing signs that the group is building a new botnet. Researchers at Security Scorecards saw a cluster tied to the group covertly routing traffic largely made up of compromised Netgear Pro, Safe Microtik and Cisco RV320 devices. This appears to be using the same core infrastructure and techniques previously seen from Volt Typhoon. Chinese Group Targets Tibetan Media Researchers at the INSICT group tracked a cyber espionage campaign by the Chinalink Group. Tag 112 this saw the group use Cobalt Strike to compromise the websites of the Tibet Post and Giud Med Tantric University, likely through their Jumla. CMS researchers say tag 112 may be a subgroup of the channeling threat actor Evasive Panda, as it shows similar tactics, although it lacks the sophistication to drop custom malware. Evasive Panda has also compromised the Tibet Post in previous attacks. DoD Leaker sentenced the US Attorney for Massachusetts announced it sentenced former Massachusetts Air National Guardsman Jack Teixeira to 15 years in prison for stealing and leaking classified information. Court documents show Teixeira shared classified documents on discord sometime in 2022, including troop movements and information on equipment provided to Ukraine. The leaks were discovered in March 2023 to share a pleaded guilty to six count related to that leak. In March 2024, as part of a plea deal, Shrink Locker Decryptor released. The cybersecurity firm bitdefender released the decryptor to help victims recover quickly from attacks. Researchers at Kaspersky first documented details on shrink locker in May 2024. The ransomware is written in VBScript and uses Windows native BitLocker utility to encrypt files, primarily targeting Indonesia, Jordan and Mexico. The researchers noted that Shrink Locker uses group policy objects and scheduled tasks to encrypt multiple systems within a network in as little as 10 minutes per device. The researchers recommend proactive monitoring of specific Windows event logs and configuring BitLocker to store recovery information in active Directory domain services as ways to reduce the risk of similar BitLocker based attacks. And now, thanks to today's episode sponsor ThreatLocker do zero day exploits and supply chain attacks keep you up at night. Worry no more. You can harden your security with Threat Locker. Threat Locker helps you take a proactive, default deny approach to cybersecurity and provides a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operations are fully supported by their US based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit threatlocker.com that's T H R E A T L O c k e r.com Hamas affiliated group targets the Middle East Researchers at check point documented activity by the Apt Wired, a group believed to be part of the Gaza cyber gang and active since August 2018. It's operating phishing campaigns against Israeli organizations and has also targeted the Palestinian Authority, Jordan, Iraq, Saudi Arabia and Egypt. These phishing attacks use a new version of the same coin wiper, which adds the ability to encrypt data on systems as well as overwriting files with random bytes. It also overwrites the system's background to display the name of the military wing of Hamas. The researchers say the group continues to iterate with multiple campaigns that shows a versatile infiltration and malware toolkit Amazon leaker claims to be an ethical hacker last week, 2.8 million lines of Amazon employee data was posted on a dark web forum by someone under the moniker Nameless. They claimed to have obtained information on dozens of companies through the moveit file transfer exploitation. Researchers at Hudson Rock verified this data, including organizations like Lenovo, Delta, HSBC and Charles Schwab. This includes names, organizational roles, contact information and department assignments so things that would primarily be used for social engineering. Nameless claimed they took this action as an ethical hacker, not obtaining the data with fake credentials and only scraping what was publicly available. They said they published the data to raise awareness of the need to encrypt PII at these organizations and not to hide behind blaming third parties for leaked data. They also told researchers that more data would be revealed in the coming days. Sheboygan hit up for a ransom the Wisconsin city has been experiencing network outages since late October. Over the weekend, it confirmed that this was caused by a threat actor gaining unauthorized access to the city's network. Officials also confirmed that the city received a ransom demand, saying, we are cooperating fully with law enforcement and incorporating their guidance into our response. Local news outlets report emergency services are seeing limited interruptions, but that all cloud based services are up and working for city employees. No group has taken credit for the attack, and city officials have been tight lipped with details. End of Life D Link NAS devices under attack Researchers at netsecfish discovered a command injection vulnerability on D Link NAS devices that allows an unauthorized attacker to use get requests to inject shell commands. This flaw has been under active exploitation since November 8. However, the impacted models, DNS320, 325 and 340L, are now end of Life, and D Link said it has no plans to release a patch. Researchers found over 41,000 unique IP addresses for vulnerable devices online. D Link advises customers to replace the devices or at the very least, restrict them from open Internet access. What is Success and failure for a Cybersecurity startup? The failure of a cybersecurity startup often looks like success from the outside, with most better off selling early. So why don't the typical startup rules apply in cybersecurity? And why are most traditional unicorns so rare? We try to answer that question in this week's episode of Defense In Depth. Look for the [e-mail] or in your favorite podcast app. Reporting for the CISO series, I'm Rich Stroffolino, reminding you to have a super sparkly day. Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.