Cyberwarfare, Espionage & Extortion Issue #6: w/e 23rd February 2024
“He who fights with monsters might take care lest he thereby become a monster. And if you gaze for long into an abyss, the abyss gazes also into you.” ― Friedrich Nietzsche, Beyond Good and Evil
TinyTurla Next Generation - Turla APT spies on Polish NGOs - Cisco Talos has identified a new backdoor authored and operated by the Turla APT group, a Russian cyber espionage threat group. This new backdoor we’re calling “TinyTurla-NG” (TTNG) is similar to Turla’s previously disclosed implant, TinyTurla, in coding style and functionality implementation.
Talos assesses with high confidence that TinyTurla-NG, just like TinyTurla, is a small “last chance” backdoor that is left behind to be used when all other unauthorized access/backdoor mechanisms have failed or been detected on the infected systems.
Bumblebee Buzzes Back in Black - Proofpoint researchers identified the return of Bumblebee malware to the cybercriminal threat landscape on 8 February 2024 after a four-month absence from Proofpoint threat data. Bumblebee is a sophisticated downloader used by multiple cybercriminal threat actors and was a favored payload from its first appearance in March 2022 through October 2023 before disappearing.
In the February campaign, Proofpoint observed several thousand emails targeting organizations in the United States with the subject "Voicemail February" from the sender "info@quarlesaa[.]com" that contained OneDrive URLs. The URLs led to a Word file with names such as "ReleaseEvans#96.docm" (the digits before the file extension varied). The Word document spoofed the consumer electronics company Humane.
The Fate of the CriminalMW Group: Endgame or a New Rebranding Journey? - A recent discovery revealed a new version of the CriminalMW Android Banking Trojan, which is being advertised for rent at a rate of $5000 per month on their Telegram channel.
The latest updates to the CriminalMW (Criminal Malware) include the implementation of new commands, a new overlay technique, the creation of Google Play Store phishing websites, and the integration of additional features.
This updated version of CriminalMW specifically targets 10 Brazilian banks through the PIX platform, leveraging an Automated Transfer System (ATS) Framework.
Insight
Beware the Lure of False Wins: The Temu Phishing Alert
Over 800 Phony “Temu” Domains Lure Shoppers into Credential Theft - In an era where online shopping blends seamlessly with the pursuit of bargains, a new cyber threat casts a shadow over digital marketplaces. The target? Unsuspecting consumers lured by the promise of rewards from Temu, a burgeoning e-commerce platform. With a user base spanning the globe, Temu's rise as a shopping app titan is undeniable. Yet, beneath the veneer of discounts and deals lies a darker narrative, meticulously crafted by scammers.
Checkpoint nets phish with tasty bait
Cybersecurity experts at Checkpoint's Harmony Email have raised the alarm over a sophisticated phishing operation masquerading under Temu's banner. The modus operandi? Enticing emails promising giveaway rewards, a classic bait now reimagined through over 800 fraudulent domains bearing Temu's name. These emails, sophisticated in their simplicity, claim to originate from "Temu Rewards," yet a closer inspection reveals their true nature: a conduit to credential theft, designed to deceive even the most vigilant of shoppers.
Trust and Safety – still important even in a trust-light world
This deceit not only exploits the trust placed in brands, but also signifies a troubling evolution in phishing scams. Historical precedents, such as the widespread campaigns against numerous brands in 2022, underscore the adaptability and persistence of cybercriminals. From the misuse of established names like Walmart and Meta Platforms to the exploitation of delivery services, the tactics may vary but the goal remains the same: to siphon off personal and financial information under the guise of legitimacy.
Data misuse and shadow brokers make for shark-infested data lakes
As Temu navigates the choppy waters of cybersecurity while facing allegations of data misuse as well as the shadow of customer data sales on the dark web, the importance of vigilance has never been more pronounced. The digital domain remains a battleground, where AI-based security measures and a comprehensive understanding of phishing techniques are the shields against an ever-evolving threat. In this digital age, the line between a genuine offer and a phishing scam blurs, reminding us that in the pursuit of a good deal, caution is the greatest bargain.
Scammers Corner
Retirees' Financial Nightmare: A Call for Change in Investment Scam Regulations
In a heart-wrenching tale of trust betrayed, an Australian retired couple has come forward with their story of losing over $2.5 million to an elaborate investment scam, shedding light on the dark underbelly of financial fraud and igniting a call for stringent reforms.
Investment schemes snare unwary investors
The couple, who chose to share their ordeal in hopes of preventing others from falling into similar traps, were enticed into a seemingly lucrative investment scheme that promised substantial returns. Seduced by the sophistication of the scam, which featured professionally designed websites, detailed investment materials, and convincing customer service representatives, they invested their life savings, only to watch them vanish.
This devastating loss not only stripped them of their financial security but also exposed the vulnerabilities within the current regulatory framework. The scammers, exploiting loopholes and operating from shadows, remained beyond the grasp of law enforcement, leaving the couple to navigate the aftermath of their financial ruin alone.
In the wake of their loss, the couple has decided to become vocal advocates for change, pushing for reforms that would tighten regulations around investment schemes, improve verification processes, and enhance the support systems for scam victims. Their story, a stark reminder of the growing sophistication of financial scams, has sparked a national conversation on the need for a more robust regulatory framework to protect unsuspecting investors.
Authorities call for more financial controls
Authorities and financial experts have rallied to the cause, emphasizing the importance of public education on the signs of investment fraud and the critical need for international cooperation in combating these cross-border scams. The couple's story has also prompted calls for the financial industry to implement stronger safeguards and for governments to revisit the legal mechanisms in place to pursue and prosecute fraudsters.
As the couple bravely shares their experience, their story serves as a cautionary tale and a beacon of hope for others. Their loss, while irrevocable, has ignited a movement aimed at ensuring that no one else must endure the pain of seeing their dreams dismantled by deceit.
Through their advocacy, they seek not only justice for themselves but a safer financial future for all, highlighting the enduring spirit of those who, even in their darkest hour, look to light the way for others. Their message is clear: awareness, vigilance, and reform are the keys to safeguarding the hard-earned savings of retirees against the ever-evolving threat of investment scams.
The Deep Dive
UK Government’s Pall Mall Process – A Noble Aspiration, or Too Little Cronyism, Too Late?
In the digital age, where cyberwarfare and espionage play pivotal roles in international relations, the UK government's Pall Mall Process emerges as a beacon of effort aimed at curtailing the rampant misuse of commercial cyber intrusion tools. Launched amidst much fanfare, this initiative aspires to bring nations together under a common banner to regulate and oversee the proliferation of cyber capabilities that, until now, have navigated the murky waters of international law largely unchecked. Upon closer inspection, however, this ambitious endeavor appears riddled with shortcomings that not only question its efficacy but also its timing and underlying motivations.
Flaws reflect the challenges to traditional government mandarins in the cyberwarfare age
As it stands, the Pall Mall Process embodies the complexities and challenges inherent in regulating the cyber domain. Its aspirations, though commendable, are undercut by timing issues, allegations of cronyism, and the daunting task of international collaboration. Very amusing as the plot from a British 70s sitcom, dangerous in real life.
A Response Overshadowed by Delays
Critics argue that the Pall Mall Process, while a step in the right direction, significantly lags behind the rapid advancements and dissemination of cyber intrusion technologies. In a domain where agility and the ability to pre-empt are key, reactive measures – however comprehensive – may fall short of addressing the root of the problem. The digital battlefield evolves at a breakneck pace, and yesterday's solutions will swiftly become today's obsolescence. This delay in response has left a window wide open for malicious actors to exploit vulnerabilities, making the initiative seem like a case of too little, too late.
The Spectre of Cronyism
Further complicating matters are the accusations of cronyism that haunt the corridors of power, casting a long shadow over the Pall Mall Process. Critics suggest that the initiative could inadvertently serve as a vehicle for the UK government to favor domestic companies, potentially skewing the playing field under the guise of regulation. Such concerns raise questions about the transparency and fairness of the process, suggesting that it might prioritize political and economic interests over genuine security concerns. The fear is that the process could become entangled in a web of nepotism, with lucrative contracts and influence peddling dictating the direction of cybersecurity policies, rather than objective risk assessments and technological neutrality.
The Challenge of International Cooperation
The global nature of cyber threats necessitates a coordinated international response, but the Pall Mall Process faces significant hurdles in fostering genuine global cooperation. Sovereign nations guard their cyber capabilities jealously, often viewing them through the lens of national security and strategic advantage. Achieving consensus on what constitutes responsible use of cyber intrusion tools, let alone enforcing such norms, poses a formidable challenge. The initiative's success hinges on its ability to bridge these divides, a task made more complicated by geopolitical tensions and competing interests.
Toward a More Inclusive and Proactive Approach
For the Pall Mall Process to transcend its limitations and realize its potential, it must embrace a more inclusive, agile, and proactive strategy. This involves not only broadening its coalition to include a wider array of stakeholders, such as civil society and the tech industry, but also anticipating future developments in cyber capabilities. It requires a shift from a reactive to a preventative stance, one that prioritizes both the development of resilient systems and the promotion of cybersecurity awareness among the general population.
Moreover, tackling the issue of cronyism demands a commitment to transparency and accountability. This includes rigorous oversight mechanisms and the establishment of clear, impartial criteria for the selection of partners and projects. Only then can it hope to make a meaningful impact in the fight against the irresponsible use of commercial cyber intrusion capabilities.
By being proactive in taking these steps, the Pall Process can reassert the initiative, regain trust, and demonstrate its legitimacy as a truly global effort to secure cyberspace.
And Finally ….
It’s been quite a week for cyber threats – as always, we at Cyberwarfare, Espionage & Extortion are sensing the movements of sea monsters by examining the swirls on the surface of the water.
A Global Overview
In a week marked by heightened digital tensions, the global stage witnessed significant developments in cyberwar, espionage, and extortion, underscoring the increasingly sophisticated landscape of cybersecurity threats.
Major Cyberattack Targets Critical Infrastructure – Early in the week, reports emerged of a coordinated cyberattack targeting critical infrastructure in multiple countries. The attackers, believed to be backed by a nation-state, exploited vulnerabilities in widely used industrial control systems. Governments and security agencies are scrambling to assess the full impact of the breach, which has disrupted operations in key sectors including energy, transportation, and water supply.
Espionage Campaign Unveiled – In a startling revelation, cybersecurity researchers uncovered a prolonged espionage campaign aimed at stealing sensitive information from governmental agencies and high-tech companies. The campaign, attributed to a well-known cyber espionage group, utilized sophisticated malware to infiltrate networks undetected. The stolen data includes intellectual property, diplomatic communications, and national security information.
Ransomware Gangs Escalate Extortion Tactics – The cyber underworld saw an escalation in ransomware activities, with prominent gangs adopting more aggressive extortion tactics. Victims this week included a major healthcare provider and a university, both of which experienced significant operational disruptions. The attackers threatened to release sensitive data unless a ransom was paid, highlighting the growing brazenness of cybercriminals.
International Cooperation to Combat Cyber Threats – On a positive note, this week also saw a renewed commitment to international cooperation in the fight against cyber threats. Leading cybersecurity agencies announced a joint initiative to share intelligence, enhance defensive capabilities, and coordinate responses to cyber incidents. This collaborative effort represents a critical step forward in addressing the global nature of cyber threats.
Looking Ahead – As the week concludes, the incidents underscore the critical importance of robust cybersecurity measures and international collaboration. With cyber threats evolving at an unprecedented pace, staying ahead of attackers remains a paramount challenge for governments, corporations, and individuals alike.
In the coming days, efforts to mitigate the impact of this week's incidents will continue, alongside investigations aimed at identifying and bringing the perpetrators to justice. The global community remains vigilant, aware that the digital battleground is ever-changing, and that resilience and cooperation are key to safeguarding our interconnected world.
Join us next week when we’ll be talking about some fascinating topics, including the global malicious activity targeting elections, what can be done about the commercial spying industry, and more.
Until then, stay safe, be vigilant, and be informed.
Thanks for reading Cyberwarfare, Espionage & Extortion! Subscribe for free to receive new posts and support my work.
Follow My Socials
- Computercrime on LinkedIn
- X (formerly Twitter)
- That Fraud Guy on Mastodon
- Read my stuff on Dark Reading
