Saturday , February 15 2025
Networking

IBM X-Force report
APT28 Hacker Group Targeting Asia in Widespread Phishing Scheme

As of March 2024, X-Force is tracking the APT28 group is carrying out phishing campaigns using fake government and non-governmental organization documents to target different regions around the world, including Central Asia, Europe, the South Caucasus, and North and South America.

The discovered lures include a mix of public and internal documents. They are related to various fields such as critical infrastructure, finance, cybersecurity, executive engagements, healthcare, maritime security, defense industrial production, and business. The cybersecurity firm is monitoring the activity cluster known as ITG05 or Fancy Bear, BlueDelta, Blue Athena, Fighting Ursa, UAC-028, TA422, Sofacy, Sednit, Pawn Storm, Iron Twilight, and FROZENLAKE.

Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Xploit_Cr3w and Blind_Virus are the two champion teams categorically for BCS ICT Fest 2025 arranged jointly by BCS and BUET....
Read More
Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

Between December 2024 and January 2025, Recorded Future's Insikt Group discovered a campaign targeting unpatched Cisco devices used by major...
Read More
Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

CISA Releases Advisories For 20 Industrial Control Systems (ICS)

On February 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued 20 advisories about serious vulnerabilities in Industrial Control...
Read More
CISA Releases Advisories For 20 Industrial Control Systems (ICS)

“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses...
Read More
“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

CVE-2023-38831
Malware campaign target Bangladeshi Government Entities: Report

A sophisticated malware campaign is targeting military and government entities in Bangladesh. It uses social engineering to deliver malicious files...
Read More
CVE-2023-38831  Malware campaign target Bangladeshi Government Entities: Report

(CVE-2025-1146
CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CrowdStrike has issued a security advisory for a serious TLS vulnerability, CVE-2025-1146, in its Falcon Sensor for Linux, Falcon Kubernetes...
Read More
(CVE-2025-1146  CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CVE-2025-0108 & CVE-2025-0110
Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Palo Alto Networks has issued advisories for two critical vulnerabilities in its PAN-OS. The vulnerabilities, CVE-2025-0108 and CVE-2025-0110, may enable...
Read More
CVE-2025-0108 & CVE-2025-0110  Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Update Now
Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC)...
Read More
Update Now  Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

This Adtech Company is Powering Surveillance of U.S. Military Personnel

Last year, a joint investigation revealed that a Florida-based data broker, Datastream Group, was selling highly sensitive location data that...
Read More
This Adtech Company is Powering Surveillance of U.S. Military Personnel

Intel Patched 374 Vulnerabilities in multiple products

In 2024, Intel addressed a remarkable 374 vulnerabilities across its software, firmware, and hardware products, distributing bug bounty rewards for...
Read More
Intel Patched 374 Vulnerabilities in multiple products

After three months of revealing that the threat actor used lures related to the Israel-Palestine war to spread a custom backdoor called HeadLace, a follow-up is necessary. APT28 has targeted Ukrainian government entities and Polish organizations with phishing emails containing implants and infostealers like OCEANMAP, MASEPIE, and STEELHOOK.

“Beginning in November 2023, we observed ITG05 using the “search-ms” URI handler, a new technique for the group, leading victims to download malware hosted on actor-controlled WebDAV servers,” said the cybersecurity analysts.

Fig. 1: Example infection chain of recent ITG05 campaign

Other attacks by the opponent used weaknesses in Microsoft Outlook (CVE-2023-23397, with a score of 9.8) to steal NTLMv2 hashes. This could allow the threat actor to exploit other weaknesses to take and use these hashes in relay attacks.

Between late November 2023 and February 2024, there were campaigns that used Microsoft Windows’ “search-ms:” URI protocol handler to trick users into downloading malware from WebDAV servers. These servers and the MASEPIE C2 servers may be hosted on compromised Ubiquiti routers, which was a botnet taken down by the U.S. government.

Fig. 1: Example infection chain of recent ITG05 campaign

Phishing attacks pretend to be from different countries such as the U.S., Azerbaijan, Armenia, Poland, Kazakhstan, Belarus, Georgia, Ukraine, and Argentina. They use government and non-government documents to start the infection process. The attacks end with the use of malware like MASEPIE, STEELHOOK, and OCEANMAP. These malware can steal files and browser data, as well as execute commands.

APT28 is capable of adapting to new opportunities by utilizing new methods of infection and taking advantage of easily accessible infrastructure. They also constantly update their malware arsenal.

Check Also

Indian Bank

Sophisticated malware attack on Indian Banks; Exposes 50,000 users

The zLabs research team found a mobile malware campaign with nearly 900 malware samples aimed …

Leave a Reply

Your email address will not be published. Required fields are marked *