InfoSecBulletin Cybersecurity for mankind
Recorded Future’s Insikt Group has discovered a major cyber threat campaign carried out by Russian-speaking hackers, possibly located in the Commonwealth of Independent States (CIS).
This campaign misuses GitHub, a platform for software development, to spread different malware. The report explains how attackers pretend to be popular software like 1Password, Bartender 5, and Pixelmator Pro to infect victims with malware that steals information like AMOS, Vidar, Lumma, and Octo. The malware variants have a shared command-and-control infrastructure, indicating a well-coordinated attack strategy to cause the most damage on different platforms.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Hackers make GitHub profiles to share infected versions of popular software. When users download these apps, their devices get malware that can steal data and do harmful actions. This shows the hackers are adaptable and use shared command-and-control systems, suggesting a well-organized cyber attack.
Insikt Group’s analysis uncovered various malware families in this campaign, such as:
Atomic macOS Stealer (AMOS): Targets macOS users by impersonating commonly used applications.
Vidar and Lumma: Information stealers that target Windows devices.
Octo: A banking trojan specifically targeting Android devices.
Attackers effectively use GitHub to manage their malicious tools and target various operating systems with different types of malware.
The campaign uses complex tactics such as domain spoofing. This means that users are redirected from harmless websites to harmful GitHub repositories. The malware tricks users by pretending to be a necessary software update or additional software, making them unknowingly download it.
Insikt Group also uncovered the backend infrastructure used in this campaign, including multiple C2 servers and the use of public file-sharing services like Dropbox and Pixeldrain to spread additional payloads. The usage of FileZilla servers for managing and disseminating malware variants highlights the campaign’s sophistication.
Insikt Group recommends several mitigation strategies, including:
*Verify the authenticity of the download sources and maintain updated antivirus and anti-malware solutions.
* Employ tools like GitGuardian and GitHub Advanced Security to scan for potentially malicious code.
* Implement an organization-wide code review process for any externally obtained code before its integration into production environments.
