Gamaredon Continues To Use SFX Archives To Deliver Implants

Industries impacted: Government

QuoIntelligence is tracking an iteration of a campaign we attribute to Gamaredon group delivering implants in the form of self-extracting package files (SFX executable). This enables the group to bundle together various files – in this context to show user a decoy Office document and in the background launch a VNC server using a UltraVNC utility. According to Office and executables files metadata, this new wave started around the second week of April.

Rollups:

Industries impacted: Consumer Discretionary, Consumer Staples, Financials, Information Technology, Materials, Real Estate, Utilities

• Lazarus Extends their “Operation Dream Job” Campaign to Targeting the Chemical Sector
• The Karakurt Extortion Group Potentially Partner With Conti Ransomware
• Lazarus Group Targeting Blockchain Companies Using Trojanized Crypto Apps
• The Group Haskers Gang Introduces New ZingoStealer Malware-As-A-Service In Their Telegram Channel Including A
• Free Version For Their Members
• Attack Campaign Involving Stolen OAuth User Tokens Issued to Third-Party Integrators
• Analysis and Kill Chain of Latest BlackCat Ransomware Incident
• FBI Links the Largest Crypto Theft to North Korean Lazarus Group and APT38
• Gamaredon: Actively Updating Tools For Activity in Ukraine

Geo Highlights

Ukraine: Fighting Intensifies in Eastern Ukraine, Global Divisions Hardening, and Cyberattacks on Critical Infrastructure

Industry impacted: Government

As the war in Ukraine is continuing without any likely end in sight, countries are reorganising their alliances and partnership that could shape a divided international structure for decades to come. Based on the recent cyberattacks on the energy sector, and the warnings regarding threats to ICS/SCADA systems and critical infrastructure at large, we assess with low confidence, that it is probable the Russian Federation is engaged in activities aiming at preparation for the deployment of destructive cyber operations.

Rollups:

Industries impacted: Communication Services, Government

• US Court Rules that Scraping Publicly Accessible Data is Legal
• NSO’s Pegasus Spyware Reportedly Used to Target Catalan, UK, EU Politicians and Organizations
• NATO Holds World’s Largest International Live-Fire Cyber Exercise