News of the Cyber World

[kyonides]

Researchers uncover potential ransomware network with U.S. connections

But researchers with Censys, a firm that indexes devices connected to the internet, said Thursday they’ve flipped the typical script and found what appears to be a ransomware command and control network capable of launching attacks, including one host located in the U.S.

Matt Lembright, Censys’ director of federal applications and author of the report, told CyberScoop that they came across the network after running a search through the company’s data for the top 1,000 software products currently observable on Russian hosts. After seeing Metasploit — penetration testing software frequently used for legitimate purposes — on just nine hosts out of more than 7.4 million, the team did some additional digging.

The team eventually found two Russian-based hosts containing a combination of Acunetix, a web vulnerability tester, and DeimosC2, a command and control tool to use on compromised machines after exploitation.

One of the hosts in the network is located in Ohio, according to the data, and was running the DeimosC2 tool as recently as July 6. Other software present on the host indicated it might be serving as a proxy in the network, and a historical review of the host revealed that it hosted malware for a short period in October 2021 later tied to the Karma ransomware strain.

So beware of the MedusaLocker ransomware.

Attackers can surveil, disrupt vehicles outfitted with popular GPS tracker, CISA warns

“Successful exploitation of these vulnerabilities could allow an attacker control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands and the disarming of various features (e.g., alarms),” according to the Cybersecurity and Infrastructure Security Agency.

The Chinese-made tracker in question is known as the MiCODUS MV720 GPS tracker. It’s used across the globe by consumers and businesses alike seeking theft protection and location management, according to the cybersecurity company BitSight, which discovered the problem earlier this year and notified CISA. BitSight and CISA collaborated on the vulnerability alert.

Government, military and law enforcement agencies as well as corporations spanning a variety of industries such as aerospace, energy, engineering, manufacturing and shipping rely on the MiCODUS tracker, BitSight said in a press release.

Security and privacy experts have long complained about GPS trackers putting people at risk due to built-in vulnerabilities. Additionally, devices such as the Apple AirTag have been used to track people without their consent. A Connecticut man was arrested and charged with stalking in February after police found an AirTag in his ex-girlfriend’s car. Law enforcement in multiple states have issued warnings alerting the public to how criminals can deploy AirTags.

Russian hacking unit Cozy Bear adds Google Drive to its arsenal, researchers say

The state-backed Russian hacking team behind some of the biggest digital intrusions in recent years has been using both Google Drive and Dropbox to deliver malware against a range of targets, researchers said Tuesday.
...
But in a series of spear phishing attacks dating back to early May, the hackers have demonstrated “sophistication and the ability to rapidly integrate popular cloud storage services to avoid detection,” most notably by mixing Google Drive’s cloud storage services into their mix.
...
Dropbox and other cloud and web services such as project management app Trello and Google’s Firebase app development platform aren’t new to the APT29 playbook, as documented in April 2022 by Mandiant and May 2021 by the Microsoft Threat Intelligence Center. But adding Google Drive brings an additional layer of threat.
...
The latest hacking campaigns highlighted by Unit 42 targeted several unnamed “Western diplomatic missions” between May and June 2022 using what appears to be compromised email accounts within foreign embassies of Portugal and Brazil. ... Building off that the researchers identified an additional campaign May 24 which consisted of two emails to the same unnamed NATO country’s ministry of foreign affairs just a few hours apart.

They even used a dropper called EnvyScout that downloads additional malware.