CYFIRMA Research

A year and a half into the Russian war in Ukraine, the defending Ukrainians are now reconstituting their attrited forces for an imminent counter-attack, which might be the last opportunity the Ukrainian commanders will get to push the occupiers out of the country, before the external support, the country is relying on gets exhausted. The future of the country hinges on the success of the counter-offensive and its success hinges on numerous factors, out of which the ability to perform combined arms maneuvers at the operational level will be the most important one in order to root out the well-entrenched Russians. In this podcast, we are going over the reasons, why this is impossible without effective external threat landscape management in the fifth domain and why cyber security is going to be absolutely vital for the geopolitical future of Europe.

Link to Research Report: https://www.cyfirma.com/outofband/the-meaning-of-etlm-for-the-coming-ukrainian-offensive/

#etlm #cyberintelligence #geopolitics #situationalawareness

https://www.cyfirma.com/

Recently KILLNET creator; ‘KillMilk’, announced that they were building a global team of operators from the darknet and special services members, with financially motivated destructive capabilities. Their operation went full circle from offering services to hackers and competing businessmen, to taking orders from private and state persons, along with defending the interests of the Russian Federation. CYFIRMA research report focused on analyzing KILLNET, Subgroups, capabilities, and recent development in the group’s motive.

Key Points

The KILLNET operation has come full circle, evolving from a service provider for hackers and competing businesses, to a private military hacker’s company that now takes orders from both private individuals and state entities, along with defending the Russian Federation’s interests.

• Ransom Distributed Denial of Service (RDDoS) attacks are possibly the next move of KILLNET and their associates, considering their capability and the recent shift in motivation.
• Initial days KILLNET and associates used tools from GitHub Repositories, along with custom-built tools to conduct DDoS attacks. Now they have specialists, who can build a botnet for the group.
• Self-destruction attacks are not possible on KILLNET, as the owners of the largest botnets are Russians, and they have a block at the level of settings for attacks in Russia or the CIS.
• Along with the DDoS campaign, KILLNET and its associate groups are also engaged in social engineering campaigns for credential harvesting.
• KILLNET now has access to Titan Stealer and a new botnet; ‘TESLA’, built by RADIS, a commander of one of the KILLNET sub-groups; As a result, the group’s attack capability is expected to be greatly improved.
• KILLNET adopted a tactic of operating through multiple groups, which creates a sense of disarray and unpredictability, and makes it harder for the targets to prepare for or defend against attacks. KILLNET has mastered the art of division of groups to conduct effective campaigns.

Link to Research Report: https://www.cyfirma.com/outofband/evolution-of-killnet-from-hacktivism-to-private-hackers-company-and-the-role-of-sub-groups/

https://www.cyfirma.com/

The PowerPress plugin, which allows WordPress users to publish and manage podcasts, was found to contain a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability allowed authenticated threat actors with contributor-level permissions or higher to inject malicious web scripts into pages, using the plugin’s shortcode, potentially leading to the theft of sensitive information, manipulation of site content, or redirection of users to malicious websites. The vulnerability was fully addressed in version 10.0.2 of the plugin, the latest version is 10.0.7. and all Wordfence users are fully protected against it. However, users are urged to update their sites to the latest patched version of PowerPress as soon as possible to ensure continued security. The vulnerability was disclosed responsibly by the Wordfence Threat Intelligence team, and the PowerPress development team responded swiftly with a patch release.

Key Takeaways:

• The PowerPress plugin, actively installed on over 50,000 WordPress websites, had a stored Cross-Site Scripting (XSS) vulnerability in versions 10.0 and earlier.
• Threat actors with contributor-level permissions or higher could inject malicious web scripts into pages using the plugin’s shortcode.
• The vulnerability has been fully addressed in version 10.0.2 of the plugin, which was released by the developer after prompt disclosure by the Wordfence Threat Intelligence team.
• Currently, the latest version is 10.0.7.

Link to Research Report: https://www.cyfirma.com/outofband/exploiting-the-powerpress-10-0-stored-cross-site-scripting-vulnerability-cve-2023-1917/

https://www.cyfirma.com/

SarinLocker is written by NecroSys, who is associated with FusionCore group. The threat actor group known as FusionCore is a relatively new and determined group, originating from Europe. The group is running Malware-as-a-service, along with hacker-for-hire services. They have a wide range of skills and rely on open-source tools to increase evasiveness in their malware toolkit. The current version of SarinLocker v1.0 may not be highly sophisticated, we anticipate that it is still undergoing development and expect that future versions will include enhanced capabilities.

Link to Research Report: https://www.cyfirma.com/outofband/sarinlocker-ransomware

https://www.cyfirma.com/

The threat actor’s named “DoNot”, also known by the name APT-C-35, is active since 2016 and has been carrying out cyber-attacks in the South Asian region. 

https://www.cyfirma.com/

In this Podcast, we'll be talking about "The impact of unauthorized access to large AI language models and their impact on the external threat landscape".

Hackers have shown a growing interest in AI models such as ChatGPT, as they seek to exploit the technology for their criminal activities. The potential use of ChatGPT by cybercriminals is concerning, as it could lead to an increase in the sophistication and scale of cyber-attacks. 

https://www.cyfirma.com/

CYFIRMA observed a new European threat actor group known as FusionCore. Running Malware-as-a-service, along with the hacker-for-hire operation, they have a wide variety of tools and services that are being offered on their website, making it a one-stop-shop for threat actors looking to purchase cost-effective yet customizable malware. The operators have started a ransomware affiliate program that equips the attackers with the ransomware and affiliate software to manage victims. FusionCore typically provides sellers with a detailed set of instructions for any service or product being sold, enabling individuals with minimal experience to carry out complex attacks. 

https://www.cyfirma.com/

ARES, is a new threat actor group identified by CYFIRMA Research. ARES is involved in selling corporate and government authority databases. CYFIRMA Research has observed cartel-like behaviour, affiliations with other threat actors, and connections with established hacking groups like RANSOMHOUSE ransomware group, KelvinSecurity, and Adrastea hacker group. ARES Leaks is potentially becoming an alternative to BreachedForum, intensifying its efforts to add more threat actors and leaks to its platform. The ARES group comprises expert penetration testers, malware developers, and other resources, offering not only data leaks but also Botnet and DDoS services. The OSINT search reveals that the group's admin is involved in selling Zero-day vulnerabilities, indicating that the group is leveraging such vulnerabilities to compromise systems. Overall, ARES Leaks' activities present a serious threat to organizations' cybersecurity.

https://www.cyfirma.com/