A China-linked cyber espionage group has compromised telecom operators in an Asian country since at least 2021.

The Symantec Threat Hunter Team reported that an alleged China-linked APT group has infiltrated several telecom operators in a single, unnamed, Asian country at least since 2021.

The threat actors used tools associated with Chinese espionage groups, they planted multiple backdoors on the networks of targeted companies to steal credentials. 

“The attacks have been underway since at least 2021, with evidence to suggest that some of this activity may even date as far back as 2020. Virtually all of the organizations targeted were telecoms operators, with the addition of a services company that serves the telecoms sector and a university in another Asian country.” reads the report published by Broadcom Symantec Threat Hunter Team.

Evidence collected by the experts suggests that the cluster activity may have been active since 2020.

In a recent espionage campaign, the attackers employed custom malware associated with several Chinese APT groups. Some of the malware used by the threat actors are:

• Coolclient: A backdoor linked to the Fireant group (also known as Mustang Panda or Earth Preta). It logs keystrokes, manages files, and communicates with a C2 server. This campaign used a version of VLC Media Player (disguised as googleupdate.exe) to sideload a Coolclient loader, which then reads and executes encrypted payloads.
• Quickheal: A backdoor associated with the Needleminer group (also known as RedFoxtrot or Nomad Panda). The variant used by the attackers in recent attacks was a 32-bit DLL that communicated with a hardcoded C&C server using a custom protocol mimicking SSL traffic.
• Rainyday: A backdoor, linked to the Firefly group (also known as Naikon), was used in a recent espionage campaign.

In addition to utilizing custom backdoors. the cyber espionage group also employed a range of tactics, techniques, and procedures (TTPs) to compromise their targets. They deployed custom keylogging malware, port scanning tools, credential theft through the dumping of registry hives, a publicly available tool known as Responder that acts as a Link-Local Multicast Name Resolution (LLMNR) NetBIOS Name Service (NBT-NS) and multicast DNS (mDNS) poisoner, and enabling RDP. 

“Tools used in this campaign have strong associations with multiple Chinese groups and at least three of the custom backdoors deployed are believed to be used exclusively by Chinese espionage actors.” concludes the report.” “The nature of the link between the actors involved in the current campaign remains unclear. Possibilities include, but are not limited to:

• Attacks by multiple actors, acting independently of one another.
• A single actor using tools and/or personnel acquired from or shared by other groups.
• Multiple actors collaborating in a single campaign.

The ultimate motive of the intrusion campaign remains unclear.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration

A new Rust malware called Fickle Stealer spreads through various attack methods and steals sensitive information.

Fortinet FortiGuard Labs researchers detected a new Rust-based information stealer called Fickle Stealer which spread through multiple attack vectors.

The malware has an intricate code and relies on multiple strategies for its distribution, including VBA dropper, VBA downloader, link downloader, and executable downloader.

Attackers typically download a PowerShell script (u.ps1 or bypass.ps1) to perform initial setup tasks. In some cases, attackers used an additional file to download the PowerShell script.

The main objective of the PowerShell script is to bypass User Account Control (UAC) and execute the Fickle Stealer malware. The script also sets up a task to run another script, engine.ps1, after 15 minutes. The script places a genuine and a fake WmiMgmt.msc file in the system directories to bypass UAC. The fake file abuses an ActiveX control to open a web browser with a local URL that serves a page for downloading and executing Fickle Stealer. This method leverages the Mock Trusted Directories technique to execute with elevated privileges without triggering a UAC prompt.

The scripts u.ps1, engine.ps1, and inject.ps1 frequently report their status by sending messages to the attacker’s Telegram bot. The script does this task downloading and executing tgmes.ps1 with each message. tgmes.ps1, is stored in the Temp folder with a random name and deleted after execution. In addition to messages, tgmes.ps1 sends victim details such as country, city, IP address, OS version, computer name, and user name to the Telegram bot.

Fickle Stealer uses a packer disguised as a legal executable. The experts speculate the author developed the packer by replacing some code of a legal executable with the packer’s code. This trick allows the malicious code to avoid static analysis.

“If the environment check is passed, Fickle Stealer sends victim information to the server. The server sends a list of target applications and keywords as a response.” reads the report. “Fickle Stealer sends all files in folders according to the list.”

The information stealer performs a series of anti-analysis checks to determine if it’s running in a sandbox or a virtual machine environment.

The malware stores stolen data in a specific JSON format that has three key-value pairs:

The malware targets crypto wallets, plugins, file extensions, and partial paths, along with applications such as AnyDesk, Discord, FileZilla, Signal, Skype, Steam, and Telegram

Fickle Stealer can steal information from web browsers powered by Chromium and the Gecko browser engine, such as Google Chrome, Microsoft Edge, Brave, Vivaldi, and Mozilla Firefox.

“In addition to some popular applications, this stealer searches sensitive files in parent directories of common installation directories to ensure comprehensive data gathering. It also receives a target list from the server, which makes Fickle Stealer more flexible. Variants receiving an updated list are observed. The frequently updated attack chain also shows that it’s still in development.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware) 

A researcher discovered a flaw that allows attackers to impersonate Microsoft corporate email accounts and launch phishing attacks.

The security researcher Vsevolod Kokorin (@Slonser) discovered a bug that allows anyone to impersonate Microsoft corporate email accounts. An attacker can trigger the vulnerability to launch phishing attacks. 

The researchers demonstrated the bug exploitation to TechCrunch, Kokorin told TechCrunch that he reported the bug to Microsoft, but the company replied that it couldn’t reproduce his findings. Then Kokorin disclosed the flaw on X.

The researcher explained that the vulnerability works when an attacker sends an email to Outlook accounts.

“Kokorin said he last followed up with Microsoft on June 15. Microsoft did not respond to TechCrunch’s request for comment on Tuesday.” reported TechCrunch. “TechCrunch is not divulging technical details of the bug in order to prevent malicious hackers from exploiting it.”

Kokorin expressed surprise at the reaction to his report, he pointed out that he was only offering assistance to Microsoft.

At this time the issue has yet to be addressed, and it is unclear if any threat actors have already exploited it in attacks in the wild.

We will continue to follow the evolution of this case.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, spoofing)

Resecurity researchers warn of a new activity of Smishing Triad, which has expanded its operations to Pakistan.

Resecurity has identified a new activity of Smishing Triad, which has expanded its operations to Pakistan. The group’s latest tactic involves sending malicious messages on behalf of Pakistan Post to customers of mobile carriers via iMessage/SMS. The goal is to steal their personal and financial information.

The code and templates used by the attackers in this smishing kit are consistent with those observed in previous instances of Smishing Triad. Previously, Resecurity described multiple episodes of Smishing Triad activity targeting online banking, e-commerce and payment systems customers in other geographies including USA, EU, UAE and KSA.

Estimating the global scale of threat actors’ activities, our analysts believe they send between 50,000–100,000 messages daily. To achieve this, they leverage stolen databases acquired from the Dark Web, which contain sensitive personal data of citizens including phone numbers. Pakistan, with a population of over 235.8 million, has experienced multiple data breaches in the first half of 2024, compromising the personal identifiable information (PII) of citizens. These records are then processed at scale using automation tools to distribute SMS spam for malicious and fraudulent purposes.

Resecurity observed multiple hosts used by attackers operating smishing kits targeting Pakistan’s postal providers, along with Correos, a state-owned postal provider in Spain, observed in previous episodes of Smishing Triad activity from July 2023. There were identified multiple domain names mapped to the same IP address 23[.]231[.]48[.]129:

• ep-gov-pkw[.]cfd
• ep-gov-ppk[.]cyou
• ep-gov-ppk[.]icu
• correosytelegrafos-civ[.]icu
• correos-es[.]cn

Smishing (SMS phishing) attacks can be deceptive and aim to trick individuals into revealing personal information or clicking on malicious links through text messages to compromise digital identity and steal payment data.

The full report is available here:

https://www.resecurity.com/blog/article/smishing-triad-is-targeting-pakistan-to-defraud-banking-customers-at-scale

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Smishing Triad)

Alleged researchers have exploited a zero-day in Kraken crypto exchange to steal $3 million worth of cryptocurrency.

Kraken Chief Security Officer Nick Percoco revealed that alleged security researchers exploited a zero-day flaw to steal $3 million worth of cryptocurrency. The researchers are refusing to return the stolen funds.

Percoco revealed that a security researcher reported an “extremely critical” bug to the exchange on June 9. The researcher did not disclose technical details about the issues, they only explained that the flaw allowed anyone to arbitrary increase the balances in a wallet.

“Everyday we receive fake bug bounty reports from people claiming to be “security researchers”. This is not new to anyone who runs a bug bounty program. However, we treated this seriously and quickly assembled a cross functional team to dig into this issue.” Percoco explained.

The kraken security team discovered “an isolated bug” that allowed an attacker, under specific circumstances, to initiate a deposit onto the platform and receive funds in their account without fully completing the deposit.

The company pointed out that the client’s assets are not at risk, however, an attacker could effectively print assets in their Kraken account for a while.

The security team addressed the vulnerability within an hour. The vulnerability derived from a recent change in the user interface that would promptly credit client accounts before their assets cleared allowing clients to effectively trade crypto markets in real time.

“This UX change was not thoroughly tested against this specific attack vector.” continues the

After patching the vulnerability, the experts discovered that three accounts exploited the vulnerability within a few days. One of these accounts was verified by an individual claiming to be a security researcher.

Percoco added that the researcher disclosed the bug to two other individuals who used it to withdraw $3 million in stolen funds from their Kraken accounts.

The company requested the researchers to return the stolen funds, but they refused.

“This is not white-hat hacking, it is extortion!” said Percoco, who added that his company notified law enforcement.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, zero-day)

Google released Chrome 126 update that addresses a high-severity vulnerability demonstrated at the TyphoonPWN 2024 hacking competition.

Google has issued a Chrome 126 security update, addressing six vulnerabilities, including a flaw, tracked as CVE-2024-6100 which was demonstrated during the SSD Secure Disclosure’s TyphoonPWN 2024. TyphoonPWN is a live hacking competition held annually at TyphoonCon, an Offensive Security Conference in Seoul, South Korea.

The vulnerability is a high-severity type confusion issue in the V8 script engine that was reported by Seunghyun Lee (@0x10n) participating in SSD Secure Disclosure’s TyphoonPWN 2024 on 2024-06-04

Lee received a $20,000 bug bounty reward for reporting the issue.

Google also addressed the following issues:

• A high-severity inappropriate implementation issue, tracked as CVE-2024-6101, in WebAssembly. @ginggilBesel reported the flaw on 2024-05-31 and Google awarded him $7000.
• A high-severity out-of-bounds memory access in Dawn, tracked as CVE-2024-6102. wgslfuzz reported the flaw on 2024-05-07.
• A high-severity use after free in Dawn tracked as CVE-2024-6103: wgslfuzz reported the flaw on 2024-06-04

Google hasn’t shared technical details on the vulnerabilities, the good news is that the company is not aware of attacks in the wild exploiting the flaws addressed by the Chrome 126 security update.

Chrome 126 security update is now rolling out to users as version 126.0.6478.114 for Linux and as versions 126.0.6478.114/115 for Windows and macOS.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)

AMD announced an investigation after a threat actor attempted to sell data allegedly stolen from its systems.

AMD has launched an investigation after the threat actor IntelBroker announced they were selling sensitive data allegedly belonging to the company.

“We are aware of a cybercriminal organization claiming to be in possession of stolen AMD data,” the chip maker told media outlets. “We are working closely with law enforcement officials and a third-party hosting partner to investigate the claim and the significance of the data.”

Earlier this week IntelBroker announced on the BreachForums cybercrime forum that they were “selling the AMD.com data breach.”

The seller states that the files were stolen in June 2024.

The allegedly stolen data includes information on future products, datasheets, employee and customer databases, property files, firmware, source code, and financial documentation.

The seller claims compromised employee data includes first and last names, job functions, business phone numbers, email addresses, and status. 

It’s unclear if the data is authentic and which it the source.

IntelBroker recently made the headlines because he attempted to sell data from Europol and Zscaler.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AMD)

A malware campaign targets publicly exposed Docker API endpoints to deliver cryptocurrency miners and other payloads.

Researchers at Datadog uncovered a new cryptojacking campaign linked to the attackers behind Spinning YARN campaign.

The threat actors target publicly exposed and unsecured Docker API endpoints for initial access.

The attack begins with the threat actor scanning the internet to find hosts with Docker’s default port 2375 open. After locating a valid host, they perform Docker reconnaissance by querying the Docker host’s version using the docker version command. Following this confirmation, the attacker starts the exploitation phase by attempting to create an Alpine Linux container and using Docker’s Binds parameter to map the host’s root directory (/) to a directory within the container (/mnt). Below is the command snippet used in the campaign:

"Image": "alpine",
"HostConfig": {
  "Binds": ["/:/mnt"]
}

If this step is successful, the attacker gains access to the Docker host’s underlying filesystem through the /mnt directory inside the container, allowing them to escalate their privileges.

In addition to defining the container image and host configuration parameters, the attacker executes a shell command within the container itself to set the root of subsequent processes.

The attackers were observed deploying multiple payloads, including a remote access tool (chkstart) that downloads and executes additional malicious payloads and a tool to perform lateral movement (exeremo) used to propagate the malware via SSH.

The threat actors used a a shell script named “vurl” to retrieve the malicious payloads from a server under their control. The script includes another shell script called “b.sh” that, in turn, packs a Base64-encoded binary named “vurl” and is also responsible for fetching and launching a third shell script known as “ar.sh” (or “ai.sh”).

“After the attacker gains initial access and achieves execution via cron, the next stage of the campaign is to fetch and execute a new shell script—b.sh. This script contains a base64-encoded tar archive of a new binary named vurl. The script decodes and extracts this binary to /usr/bin/vurl, overwriting the existing shell script version, before fetching and executing one of two shell scripts—ar.sh or ai.sh.” reads the report published by the researchers.

The attackers use an unusual persistence mechanism by modifying existing systemd services and using the ExecStartPost configuration option to execute malicious commands.

The shell script “ar.sh” is used for multiple purposes including setting up a working directory, installing tools to scan the internet for vulnerable hosts, remove existing cron entries, weaken the system by disabling firewalls, clearing shell history, and preventing new lines from being added to the history file.

The script is ultimately used to fetch the next-stage payload “chkstart.”

Attackers used Golang binary, such as vurl, to set up a remote access and download additional tools from a remote server. The experts observed attackers downloading “m.tar,” and an XMRig miner called “top,”.

“This update to the Spinning YARN campaign shows a willingness to continue attacking misconfigured Docker hosts for initial access. The threat actor behind this campaign continues to iterate on deployed payloads by porting functionality to Go, which could indicate an attempt to hinder the analysis process, or point to experimentation with multi-architecture builds.” concludes the report.

“Although the likely objective of this campaign is to deploy an XMRig miner to compromised hosts, the attackers also ensured that they maintain access to victim machines via SSH. Maintaining remote code execution to victim hosts could mean that attackers can leverage their access for additional objectives”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Docker)

VMware addressed vCenter Server vulnerabilities that can allow remote code execution or privilege escalation.

VMware addressed multiple vCenter Server vulnerabilities that remote attackers can exploit to achieve remote code execution or privilege escalation.

vCenter Server is a centralized management platform developed by VMware for managing virtualized environments.

The vCenter Server contains multiple heap-overflow flaws, tracked as CVE-2024-37079, CVE-2024-37080 (maximum CVSSv3 base score 9.8), in the implementation of the DCERPC protocol.

“A malicious actor with network access to vCenter Server may trigger these vulnerabilities by sending a specially crafted network packet potentially leading to remote code execution.” reads the advisory published by the company.

Customers are recommended to install the released security patches, no workarounds are available.

The vulnerabilities were reported by Hao Zheng (@zhz) and Zibo Li (@zbleet) from TianGong Team of Legendsec at Qi’anxin Group.

VMware also addressed multiple local privilege escalation vulnerabilities, tracked as CVE-2024-37081 (maximum CVSSv3 base score of 7.8), in the vCenter Server. 

“The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.” reads the advisory. “An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.”

The issue was reported by Matei “Mal” Badanoiu from Deloitte Romania

VMware confirmed that it is not aware of attacks in the wild exploiting these issues.

The following table reports impacted products and fixed versions:

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, VMware)