Tuesday , April 1 2025
Networking

IBM X-Force report
APT28 Hacker Group Targeting Asia in Widespread Phishing Scheme

As of March 2024, X-Force is tracking the APT28 group is carrying out phishing campaigns using fake government and non-governmental organization documents to target different regions around the world, including Central Asia, Europe, the South Caucasus, and North and South America.

The discovered lures include a mix of public and internal documents. They are related to various fields such as critical infrastructure, finance, cybersecurity, executive engagements, healthcare, maritime security, defense industrial production, and business. The cybersecurity firm is monitoring the activity cluster known as ITG05 or Fancy Bear, BlueDelta, Blue Athena, Fighting Ursa, UAC-028, TA422, Sofacy, Sednit, Pawn Storm, Iron Twilight, and FROZENLAKE.

CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw

Canon has announced a critical security vulnerability, CVE-2025-1268, in printer drivers for its production printers, multifunction printers, and laser printers....
Read More
CVE-2025-1268  Patch urgently! Canon Fixes Critical Printer Driver Flaw

Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

RamiGPT is an AI security tool that targets root accounts. Using PwnTools and OpwnAI, it quickly navigated privilege escalation scenarios...
Read More
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

Australian fintech database exposed in 27000 records

Cybersecurity researcher Jeremiah Fowler recently revealed a sensitive data exposure involving the Australian fintech company Vroom by YouX, previously known...
Read More
Australian fintech database exposed in 27000 records

Over 200 Million Info Leaked Online Allegedly Belonging to X

Safety Detectives' Cybersecurity Team found a forum post where a threat actor shared a .CSV file with over 200 million...
Read More
Over 200 Million Info Leaked Online Allegedly Belonging to X

FBI investigating cyberattack at Oracle, Bloomberg News reports

The Federal Bureau of Investigation (FBI) is probing the cyberattack at Oracle (ORCL.N), opens new tab that has led to...
Read More
FBI investigating cyberattack at Oracle, Bloomberg News reports

OpenAI Offering $100K Bounties for Critical Vulns

OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
OpenAI Offering $100K Bounties for Critical Vulns

Splunk Alert User RCE and Data Leak Vulns

Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
Splunk Alert User RCE and Data Leak Vulns

CIRT alert Situational Awareness for Eid Holidays

As the Eid holidays near, cybercriminals may try to take advantage of weakened security during this time. The CTI unit...
Read More
CIRT alert Situational Awareness for Eid Holidays

Cyberattack on Malaysian airports: PM rejected $10 million ransom

Operations at Kuala Lumpur International Airport (KLIA) were unaffected by a cyber attack in which hackers demanded US$10 million (S$13.4...
Read More
Cyberattack on Malaysian airports: PM rejected $10 million ransom

Micropatches released for Windows zero-day leaking NTLM hashes

Unofficial patches are available for a new Windows zero-day vulnerability that allows remote attackers to steal NTLM credentials by deceiving...
Read More
Micropatches released for Windows zero-day leaking NTLM hashes

After three months of revealing that the threat actor used lures related to the Israel-Palestine war to spread a custom backdoor called HeadLace, a follow-up is necessary. APT28 has targeted Ukrainian government entities and Polish organizations with phishing emails containing implants and infostealers like OCEANMAP, MASEPIE, and STEELHOOK.

“Beginning in November 2023, we observed ITG05 using the “search-ms” URI handler, a new technique for the group, leading victims to download malware hosted on actor-controlled WebDAV servers,” said the cybersecurity analysts.

Fig. 1: Example infection chain of recent ITG05 campaign

Other attacks by the opponent used weaknesses in Microsoft Outlook (CVE-2023-23397, with a score of 9.8) to steal NTLMv2 hashes. This could allow the threat actor to exploit other weaknesses to take and use these hashes in relay attacks.

Between late November 2023 and February 2024, there were campaigns that used Microsoft Windows’ “search-ms:” URI protocol handler to trick users into downloading malware from WebDAV servers. These servers and the MASEPIE C2 servers may be hosted on compromised Ubiquiti routers, which was a botnet taken down by the U.S. government.

Fig. 1: Example infection chain of recent ITG05 campaign

Phishing attacks pretend to be from different countries such as the U.S., Azerbaijan, Armenia, Poland, Kazakhstan, Belarus, Georgia, Ukraine, and Argentina. They use government and non-government documents to start the infection process. The attacks end with the use of malware like MASEPIE, STEELHOOK, and OCEANMAP. These malware can steal files and browser data, as well as execute commands.

APT28 is capable of adapting to new opportunities by utilizing new methods of infection and taking advantage of easily accessible infrastructure. They also constantly update their malware arsenal.

Check Also

zero-click

WhatsApp patched zero-click flaw exploited in spyware attacks

WhatsApp has patched a zero-click, zero-day vulnerability used to install Paragon’s Graphite spyware following reports …

Leave a Reply

Your email address will not be published. Required fields are marked *