InfoSecBulletin Cybersecurity for mankind
Recorded Future’s Insikt Group has discovered a major cyber threat campaign carried out by Russian-speaking hackers, possibly located in the Commonwealth of Independent States (CIS).
This campaign misuses GitHub, a platform for software development, to spread different malware. The report explains how attackers pretend to be popular software like 1Password, Bartender 5, and Pixelmator Pro to infect victims with malware that steals information like AMOS, Vidar, Lumma, and Octo. The malware variants have a shared command-and-control infrastructure, indicating a well-coordinated attack strategy to cause the most damage on different platforms.
Intel Issues Alert on 20+ Vulnerabilities, Urges Firmware Updates
Urgent: GitLab Patches flaws allowing unapproved pipeline Job Execution
Fortinet admits data breach after hacker claims to steal 440GB
Gov.t issues high alert on android devices
TD Bank fined $28 million for sharing customer data
Global-Cybersecurity-Index
Bangladesh secure role-model position by ITU
New RansomHub Attack Kill Kaspersky’s TDSSKiller To Disable EDR
Not Enough, Say Experts
India set to train 5000 ‘Cyber Commandos’
Researcher detect 21 New Ransomwares in August
Microsoft patch September 2024 fixes 4 zero-days, 79 flaws
Hackers make GitHub profiles to share infected versions of popular software. When users download these apps, their devices get malware that can steal data and do harmful actions. This shows the hackers are adaptable and use shared command-and-control systems, suggesting a well-organized cyber attack.
Insikt Group’s analysis uncovered various malware families in this campaign, such as:
Atomic macOS Stealer (AMOS): Targets macOS users by impersonating commonly used applications.
Vidar and Lumma: Information stealers that target Windows devices.
Octo: A banking trojan specifically targeting Android devices.
Attackers effectively use GitHub to manage their malicious tools and target various operating systems with different types of malware.
The campaign uses complex tactics such as domain spoofing. This means that users are redirected from harmless websites to harmful GitHub repositories. The malware tricks users by pretending to be a necessary software update or additional software, making them unknowingly download it.
Insikt Group also uncovered the backend infrastructure used in this campaign, including multiple C2 servers and the use of public file-sharing services like Dropbox and Pixeldrain to spread additional payloads. The usage of FileZilla servers for managing and disseminating malware variants highlights the campaign’s sophistication.
Insikt Group recommends several mitigation strategies, including:
*Verify the authenticity of the download sources and maintain updated antivirus and anti-malware solutions.
* Employ tools like GitGuardian and GitHub Advanced Security to scan for potentially malicious code.
* Implement an organization-wide code review process for any externally obtained code before its integration into production environments.
