| New Threat Detection Added | 2 (Parrot TDS and SquidLoader Malware) |
| New Threat Protections | 119 |
Weekly Detected Threats
The following threats were added to Crystal Eye XDR this week:
Threat name: | Parrot TDS | ||||||||||||||||||||||||
A new cyber threat called Parrot TDS has infected over 16,500 websites, including university and government sites. This system redirects users to malicious campaigns like FakeUpdate, which tricks them into downloading remote access tools. Unlike prior threats, Parrot TDS targets a wider range of poorly secured websites, putting millions at risk. Researchers identified a surge in activity in February 2022 and estimate Parrot TDS has been active since October 2021. They protected over 600,000 users from visiting infected sites in a month, with Brazil, India, and the US being the most impacted. | |||||||||||||||||||||||||
Threat Protected: | 03 | ||||||||||||||||||||||||
Rule Set Type: |
| ||||||||||||||||||||||||
Class Type: | Trojan-activity | ||||||||||||||||||||||||
Kill Chain: |
| ||||||||||||||||||||||||
Threat name: | SquidLoader Malware | ||||||||||||||||||
Researchers have identified a new, evasive malware loader named SquidLoader, which targets Chinese organisations through phishing campaigns. SquidLoader utilises various techniques to evade detection and deploys a Cobalt Strike payload. LevelBlue Labs suspects this actor has been active for over two years with a focus on Chinese targets. While the current campaign targets a specific region, the techniques used by SquidLoader could be adopted by other malware creators in future attacks, posing a threat to a wider audience. | |||||||||||||||||||
Threat Protected: | 01 | ||||||||||||||||||
Rule Set Type: |
| ||||||||||||||||||
Class Type: | Trojan-activity | ||||||||||||||||||
Kill Chain: |
| ||||||||||||||||||
Known exploited vulnerabilities (Week 3 - June 2024)
Threat | CVSS | Description | |
CVE-2024-31982 | 10.0 (Critical) | XWiki Remote Code Execution Vulnerability | |
CVE-2024-28999 | 8.1 (High) | SolarWinds Race Condition Vulnerability | |
CVE-2024-34470 | Ongoing Analysis | HSC Mailinspector Path Traversal Vulnerability |
For more information, please visit the Red Piranha Forum:
https://forum.redpiranha.net/t/known-exploited-vulnerabilities-catalog-3rd-week-of-june-2024/480
Updated Malware Signatures (Week 3 - June 2024)
Threat | Description | |
Nanocore | The Nanocore trojan, built on the .NET framework, has been the subject of multiple source code leaks, resulting in its widespread accessibility. Like other remote access trojans (RATs), Nanocore empowers malicious actors with complete system control, enabling activities such as video and audio recording, password theft, file downloads, and keystroke logging. | |
Remcos | Remcos functions as a remote access trojan (RAT), granting unauthorised individuals the ability to issue commands on the compromised host, record keystrokes, engage with the host's webcam, and take snapshots. Typically, this malicious software is distributed through Microsoft Office documents containing macros, which are often attached to malicious emails. | |
Lumma Stealer | A type of malware classified as an information stealer. Its primary purpose is to steal sensitive information from infected systems, including but not limited to credentials, financial information, browser data, and potentially other personal or confidential information. |
| Ransomware Report | |
The Red Piranha Team actively collects information on organisations globally affected by ransomware attacks from various sources, including the Dark Web. In the past week alone, our team uncovered new ransomware victims and updates on previous victims across 18 industries spanning 21 countries. This underscores the widespread and indiscriminate impact of ransomware attacks, emphasising their potential to affect organisations of varying sizes and sectors worldwide. Qilin and Ransomhub ransomware groups stand out as the most prolific, having updated a significant number of victims (9%) each distributed across multiple countries. In comparison, Medusa and Space Bears ransomware updated 8% victims each, in the past week. The following list provides the victim counts in percentages for these ransomware groups and a selection of others. | |
| Name of Ransomware Group | Percentage of new Victims last week |
8Base | 7.06% |
Abyss-Data | 1.18% |
Akira | 4.71% |
Arcus Media | 3.53% |
Bianlian | 1.18% |
Black Suit | 2.35% |
Blackbasta | 5.88% |
Cactus | 4.71% |
Cicada3301 | 3.53% |
Cloak | 1.18% |
1.18% | |
Darkvault | 2.35% |
Dragonforce | 1.18% |
Eraleign (Apt73) | 1.18% |
Handala | 2.35% |
Hunters | 4.71% |
Inc Ransom | 7.06% |
1.18% | |
Medusa | 8.24% |
Metaencryptor | 1.18% |
Money Message | 1.18% |
Qilin | 9.41% |
Ransomhouse | 1.18% |
Ransomhub | 9.41% |
Rhysida | 3.53% |
Space Bears | 8.24% |
Team Underground | 1.18% |
Qilin Ransomware
Emerging in July 2022, Qilin ransomware, also known as Agenda, has established itself as a formidable threat actor in the cybercrime landscape. This ruthless malware operates using a double extortion model, crippling victims by encrypting their data and threatening to leak it on the dark web if ransom demands aren't met. While the exact origins of Qilin remain unclear, security researchers believe it might be linked to a cybercriminal group operating as as-a-service. This group offers its ransomware tools and expertise to affiliates who launch attacks against various targets.
Tactics, Techniques, and Procedures (TTPs):
Qilin isn't a one-trick pony. It possesses a diverse arsenal of tactics, techniques, and procedures (TTPs) to infiltrate and compromise systems. Here's a glimpse into its malicious toolkit:
- Phishing Attacks: Deceptive emails designed to trick users into clicking malicious links or downloading infected attachments are a common entry point. These emails may appear to be from trusted sources such as delivery companies, financial institutions, or even colleagues.
- Exploiting Unpatched Vulnerabilities: Qilin actively seeks out unpatched vulnerabilities in software and operating systems to gain unauthorised access to networks. This underscores the importance of keeping all software and systems updated with the latest security patches.
- Remote Desktop Protocol (RDP) Exploitation: Like other ransomware strains, Qilin can exploit weaknesses in RDP configurations to gain access to a system. RDP allows remote access to a computer, and misconfigured settings can create a vulnerability for attackers.
- Brute-Force Attacks: In some instances, Qilin may attempt to gain access through brute-force attacks, where it systematically tries different combinations of usernames and passwords until it cracks the login credentials. This highlights the importance of using strong passwords and enabling multi-factor authentication (MFA) where possible.
- Living-off-the-Land Techniques: Like many malware strains, Qilin can utilise legitimate system administration tools for malicious purposes. This makes detection more challenging as these tools may appear as normal system activity.
Read all about Living-off-the-land techniques and how ATPs use them. - Data Exfiltration: Before encryption, Qilin often exfiltrates sensitive data like financial records, personal information, and intellectual property. This stolen data serves as additional leverage in extortion attempts, putting pressure on victims to pay the ransom.
- Strong Encryption: The malware utilises robust encryption algorithms to render files inaccessible. Decrypting them without the attacker's key is extremely difficult, if not impossible. This effectively cripples a victim's operations until a decision is made.
A Global Reach with Focused Targets:
Qilin ransomware demonstrates a lack of geographical bias, targeting victims worldwide. Here are some examples of its reach and the damage it has caused:
- Critical Infrastructure: Security researchers have observed that Qilin targets critical infrastructure sectors like power grids and transportation systems. A successful attack on such infrastructure could have devastating consequences.
- Healthcare Organisations: Hospitals and other healthcare providers have also fallen victim to Qilin attacks. The disruption caused by encrypted medical records and operational systems can severely impact patient care.
- Educational Institutions: Schools and universities haven't been spared either. Data breaches involving student information or disruption of educational services can have serious consequences.
Leak Site: Qilin ransomware maintains a leak site on the dark web where they threaten to publish stolen data if the ransom is not paid.