Threat Actors Capitalize on Recent Events: Ransomware/Malware Activity on the Rise

Strategic Insights -

Threat actors are taking advantage of the recent death of Queen Elizabeth II to launch a phishing campaign targeting Microsoft users. The attackers aim to exfiltrate victims' multi-factor authentication (MFA) codes and compromise their Microsoft account credentials. This campaign is just one of many recent incidents highlighting the increasing threat of ransomware and malware activity.

Key Takeaways:

  • Threat actors have begun taking advantage of the recent death of Queen Elizabeth II to launch a phishing campaign targeting Microsoft users.
  • The campaign's goal is to exfiltrate victims' MFA codes and compromise their Microsoft account credentials.
  • The attackers are using the EvilProxy reverse-proxy Phishing-as-a-Service (PaaS) kit in the campaign.
  • Microsoft users must remain vigilant of threat actors attempting to take advantage of recent tragedies or big news stories.
  • The UK's National Cyber Security Center (NCSC) has published an article on potential scams rising during national mourning.
  • Threat actors have also compromised Uber's internal network, gaining access to AWS, GCP, and HackerOne accounts.
  • The attacker, an 18-year-old male, stated they have been practicing cybersecurity skills for years.
  • The threat actor resorted to messaging the user on WhatsApp, claiming to be Uber IT, and asking the user to accept the authentication request.
  • The attack vector is similar to those conducted by the teenagers who ran the LAPSUS$ group.
  • The US Department of Treasury has sanctioned ten Iranian individuals connected with malicious state-sponsored cyber campaigns.
  • The individuals were identified as employees/associates of the Iranian-based Najee Technology and Afkar System companies.
  • The sanctioned threat actors have been attributed to malicious cyber campaigns going back at least two years.
  • Gamaredon, a Russian cyber-espionage threat group, has launched a new phishing campaign against Ukraine.
  • The email phishing campaign targets Ukrainian citizens with Microsoft Office document templates laced with VBScript macros.
  • The indicators of compromise from this campaign overlap with an attack series on Ukraine's Computer Emergency Response Team (CERT-UA).
  • Microsoft has patched a zero-day vulnerability allowing threat actors to escalate local privileges to SYSTEM.
  • The vulnerability, CVE-2022-37969, has been actively exploited in-the-wild.
  • EOP flaws are highly sought after by threat actors, often being one of the first actions taken after gaining initial access to a vulnerable system.
  • The Russian cyber-espionage threat group, SecureWorks, has discovered a flaw in Microsoft's Azure Active Directory (Azure AD).
  • The flaw allows threat actors to gain persistence and virtually undetectable access to a target's Azure AD instance.
  • The vulnerability does not pose any additional risk due to requiring access to the victim device.

Statistics:

  • 64 vulnerabilities were patched across Microsoft's hardware and software products in the September 2022 Patch Tuesday security update.
  • 5 critical remote code execution (RCE) flaws were discovered in the patch.
  • 2 zero-day vulnerabilities were patched, including the actively exploited Windows zero-day CLFS driver EOP vulnerability.
  • The CVE-2022-37969 vulnerability has been given a CVSS score of 7.8/10.
  • The US Department of Treasury has placed a $10 million bounty on each of the three indicted Iranian individuals.
  • The sanctioned threat actors have been connected with malicious cyber campaigns going back at least two years.

Sources:

  • Proofpoint: Queen Elizabeth II Phishing Campaign Tweets
  • The New York Times: Uber Attack Article
  • The Hacker News: Iranian Sanctions Article
  • SecureWorks: Azure Active Directory Report
  • Microsoft: September 2022 Patch Tuesday Security Update Guide