Sysbraykr.com, News - The cyber threat landscape in 2023 showed that criminals are relentlessly innovative. Criminals evolved and this demanded constant vigilance and adaptation by cyber security practitioners.

When the World Economic Forum publishes a list of ‘trends’ in cyber threats it is a sure sign that the impact of attacks and breaches on the overall economy is significant. At the beginning of each calendar year it is traditional to reflect on, and tally-up from the previous year, emerging trends in cyber attacks. It is good to understand the Tools, Techniques and Procedures (TTP) of the adversaries we face. It is also good to spot any new methods or any shift in targets, the better to be prepared for the coming year.

To help with this many top security companies, with customers across the globe, publish their own reports on such trends in attack modes and targets. One report that is always eagerly anticipated is from IBM. Their X-Force Threat Intelligence Index 2024 identifies trends in all these vital areas, based on data from 2023.

Picking out some highlights, as the report runs to a hefty 64 pages, the methods for Initial Access are shifting. The use of legitimate credentials is now top of the list, with phishing knocked off the top spot from last year into second. Third place goes to internet facing applications with exploitable weaknesses. This trend is a sign that detection and prevention methods within the security framework are having some success. Breaking in to most corporate networks is very difficult without some form of legitimate ‘foothold’. Another observation from IBM’s team is a possible shift in emphasis for some ransomware groups: rather than encrypting and ‘ransoming’ a companies data they prefer to simply steal it. There has been a 266% increase in the use of infostealer software such as Rhadamanthys, LummaC2 and StrelaStealer.

Two other significant takeaways from the report are that 84% of attacks on critical infrastructure (energy, telecoms, water etc.) gained initial access through preventable weaknesses and that attacks in Europe increased by 31% year on year. Regarding the critical infrastructure attacks the report concludes that better asset and patch management, along with credential hardening and using the principle of least privilege, could have prevented these attacks.

There was at least one positive in the report. They concluded that ransomware gangs were taking longer to elevate privileges within Active Directory controlled domains than previously. This is the equivalent of ‘shows some improvement, could do better’ on your school homework. As a final ‘food for thought’ from this report comes the news that Europe accounted for 31% of IBM’s X-Force team’s incidents that they responded to and within that the UK was the primary target.

Change Healthcare, BlackCat, $22M payout and no honour among thieves

In late February Nashville-based Change Healthcare, which reportedly handles more than 15 billion healthcare transactions annually, began having problems. Users reported connectivity issues and applications suddenly became unavailable. An immediate effect of this was difficulty in filling prescriptions and receiving payments from insurers for care. The US Military were using the service and were forced to shift to a manual method for filling prescriptions, worldwide.

Following investigation it emerged that Change Healthcare had been breached by the BlackCat/AlphV cybercrime group. This is the same group that were linked to the MGM Resorts hack from 2023. After initially filing what is known as an 8-K report to the US Securities and Exchange Commission attributing the breach to a ‘nation-state associated cyber security threat actor’ independent researchers have said that BlackCat/AlphV is a Russian-speaking group but have not linked it to any government.

Various observers of the changing cybersecurity landscape have noted that crime groups pay less attention to credit cards today since they can be easily rendered useless on discovery of the theft. Personal data and healthcare data in particular is a more valuable and less perishable commodity.

Change Healthcare had recently completed a $7.8 billion merger in 2022 with Optum, and incidents like this are fuelling anti-trust experts’ suspicions about centralising too many healthcare services.

However the temptations to centralise and consolidate are financially persuasive. United Health Group, which owns Change Healthcare, made more than $370 billion in revenue in 2023, with $22 billion of that as profit.

Clearly the cybercrime gang were fully aware of the size and wealth of the company. Although neither Change Healthcare nor their parent, United Healthcare, has admitted paying any ransom there is clear evidence on the Bitcoin blockchain that a payment of 350 Bitcoin (roughly equivalent to $22 million) was made. Recorded Future and TRM Labs, blockchain analysis firms, both confirmed that BlackCat/AlphV received this large payment.

In the cybercrime business model the organising group, in this case BlackCat/AlphV, will usually take around 20-30% of any ransom. The bulk will go to the ‘affiliates’ who actually perform the breach and ransomware activity.  In this case however there seems to have been a breach of contract. Two days after the $22 million transaction someone describing themselves as an affiliate of AlphV posted to RAMP, a cybercriminal dark web forum, that AlphV had cheated them out of their share of the ransom, even pointing to the $22 million transaction as proof.

In another unusual twist it appeared at first sight that the BlackCat/AlphV darknet site had been seized by law enforcement when a seizure page replaced the normal landing page. However the takedown notice appears to be a fake, further suggesting that this looks more like members of BlackCat/AlphV simply taking all the money, pretending, rather ineffectively, that they had been compromised. AlphV’s site was taken down for real in December 2023 and ironically the fake takedown page seems to have been copied from that actual takedown of their previous site.

There is no happy ending to this story as it stands. Since the affiliate hackers have been ripped off by their bosses they may now be tempted to go back to Change Healthcare and explain that they still have, reportedly, some 4TB of data and demand a similar ransom again.

We have mentioned before the difficulties in paying ransoms. We have seen that many insurance firms used to view paying the ransom as the most efficient means to restore their clients’ business. However as news of what is a very high payout spreads there are bound to be more gangs attempting to emulate AlphV.

When nation states attack

Much has been written recently about Chinese State hacking and election interference in the UK. The National Cyber Security Centre (NCSC) has officially blamed this interference on a group known as APT31. This refers back to incidents and compromises from 2021 and 2022 but readers of this blog and some of my other articles will recall that one of the hardest aspects of cybersecurity is identifying a culprit, or attribution. The very fact that NCSC (and by inference GCHQ) are confident enough to publish their thoughts is significant.

A brief piece of history might be appropriate here. In 2004 Kevin Mandia, a former USAF officer, started a company called Red Cliff. It was rebranded in 2006 as Mandiant. In 2013 Mandiant released a report documenting evidence of cyber attacks by the People’s Liberation Army (PLA), the military arm of the Chinese Communist Party. The report had been at least three years in the making but what set it apart from other documents about intrusions was that Mandiant’s team of hunters had traced the attackers to source. It had proof that the attacks originated from a particular unit of the PLA, Unit 61398. The Mandiant team had even uncovered individual members of the unit, their home addresses and contact details. Although China naturally denied everything, it was irrefutable. I was able to meet, and attend a presentation by, Kevin Mandia in San Francisco shortly after the report was published — and it was a revelation.

This paved the way for other security companies to refine and develop their attribution techniques. It also announced Mandiant as a leading security company and they are something of a ‘go to’ specialist to triage and investigate the biggest security issues, like the Solar Winds breach and the Colonial Pipeline breach. First acquired by FireEye in late 2013, for a reported $1 Billion, the company is now part of the Google empire. Bought for $5.4 Billion in 2022 it is part of the Google Cloud division although trading under its own name.

This aspect of cyber security is more difficult today as many attackers do not need to use specialised, custom code. Rather, they make use of existing and often old tools. This has a dual purpose as it saves development time while also complicating attribution.

As a direct result of the Chinese hacking within the UK, the Government has announced sanctions.

In the US meanwhile a group of Chinese nationals has been charged with various offences involving sending malicious emails — more than 10,000 — to US officials, the justice department and the FBI. These will be the foot soldiers, tasked with snagging the unwary with phishing emails to be handed on to military cyber attackers operating from within China.

Unsurprisingly, a spokesperson for the Chinese embassy in Washington DC said ‘without valid evidence, relevant countries jumped to an unwarranted conclusion’ and ‘made groundless accusations’.

In this case the phishing emails pretended to come from prominent media outlets or journalists. Rather than containing actual malware or directly linking to hostile sites, the emails simply carried hidden tracking links which enabled details of the location, IP address etcetera of any target that opened the email to be sent to the attacker’s server. Once more specific information was know on a target an individualised email could be developed with a greater chance of success. It also allowed focused reconnaissance enabling direct compromise of routers or devices at some target’s locations.

No longer headline news?

As someone that takes more than a passing interest in cyber security and the continued ingenuity of the attackers, I still read all reports keenly. While I am more interested in the techniques being used I still register the impact of these intrusions. I’m not sure this is generally the case. In an alarming report on the itgovernanceusa.com website at the beginning of May they reported:

‘5,136,645,282 known records breached so far in 2,098 publicly disclosed incidents’

A sister website for Europe, itgovernance.eu, reports similar statistics:

‘2,289,599,662 known records breached so far in 556 publicly disclosed incidents’

While the numbers appear quite a bit better for Europe the actual numbers are still depressingly high.

Let’s take a look at the two largest breaches, measured by amounts of data compromised, for each region.

Spy.pet Discord ‘breach?’ (USA)

Top of the charts in the US report is data from Discord. This is an interesting one since, technically, it could be argued that all Spy.pet do for their ‘service’ is harvest messages from Discord servers. In fact they have apparently harvested more than 4 billion messages, from 620 million users across 14,000 Discord servers. This trove of privacy-trampling data can be yours, for a fee.

The data is arranged in user profiles, which include all known aliases, connected accounts to other platforms such as Steam and GitHub, Discord servers joined, and public messages. If you wanted to  spy on a Discord user or users, Spy.pet lets you do that.

Such is the uncertainty over whether any crime has been committed that TheRegister asked Discord for comment and were told:

‘Discord is committed to protecting the privacy and data of our users. We are currently investigating this matter. If we determine that violations of our Terms of Service and Community Guidelines have occurred, we will take appropriate steps to enforce our policies. We cannot provide further comments as this is an ongoing investigation.’

Some unexpected customers for this nicely organised data are law enforcement and those wishing to train AIs. Much the same as the sage advice given to people following Oliver North’s embarrassment at having emails he thought he’d deleted resurface during the Iran-Contra trials, only write something in an email (or on Discord) that you don’t mind everyone reading.

Joking aside, privacy seems the next logical step for society to grapple with after the basics of online security are handled. With the explosion of computing power and the ability for almost anyone to harness software that was once the province of only sophisticated states, personal data in all forms must be protected as much as possible. This includes messages, online habits, locations and the wealth of meta-data involved in any/all online activity. Gradually the general public are realising not only how much data is recorded about them but the various ways in which this data may be mined for inferred details about their lives and habits that they would prefer remained private.

Zenlayer Cloud Server Provider: c.380 million records

The second largest, by amount of data, from the US so far this year is from a company called Zenlayer that provides cloud servers on demand. This was discovered by a security researcher, Jeremiah Fowler, who reported it to Zenlayer. Although they did not give him the courtesy of a reply he noted that they secured the database immediately.

Zenlayer, quoting from Fowler’s article:

‘Zenlayer is a global network services provider. It offers solutions such as SD-WAN (Software-Defined Wide Area Network), CDN (Content Delivery Network), and cloud services. According to their website, they provide services to well-known global brands in industries such as telecom, gaming, media and entertainment, cloud computing, and blockchain. Zenlayer is headquartered in Los Angeles and Shanghai, but it also has offices in Mumbai, Singapore, Hong Kong, Beijing, and Shenzhen. Additionally, Zenlayer claims to have 290+ data centers on six continents. According to a press release, Zenlayer ranked #3 on the Financial Time’s list of the Americas’ Fastest Growing Telecom Companies in 2021. Then, in 2023, the company was recognized as Amazon Web Service’s (AWS) partner of the year.’

The unsecured database was about 57GB in total. This data included a variety of the server logs alongside customer data. There were internal emails exposed, which would have value when organising targeted phishing attacks. Other miscellaneous data the researcher discovered were details of VPN configuration and other internal network details that would be valuable to a potential attacker.

Following this discovery the researcher looked further and found additional data exposed on a subdomain. This was accessible through a browser (from Fowler’s article):

‘It identified customers, disclosing their information in a URL format that could be viewed in any browser. The customer numbers run in chronological order and could be seen by simply changing the number such as customer/001, customer/002, customer/003, etc. This was not a database but a web base listing of Zenlayer’s users in a plain text html format. Each of these records indicated the customer’s email, phone number, ID number, billing method, name of the business, and number of employees.’

Again, unlike our normal items involving nefarious cybercrime groups making off with data to sell it via Dark Web marketplaces and hacker forums, this probably had a happy ending. Fowler reported the weakness he had found and the company closed the hole. But as always in situations like this it is impossible to know if Jeremiah was the first to spot this hole. Since much of this data could feed into more targeted attacks against entities whose data was exposed, it may take some time to determine any real world fallout.

Now let’s turn our attention to Europe.

Russian research centre Planeta: Ukraine says 2 PB of data wiped

The ongoing war in Ukraine continues to provide a glimpse of what future conflicts may look like, encompassing not only war in the air, on the ground and at sea, but also cyberwarfare. One of the latest incidents to be made public is a claim by Ukraine to have successfully breached a Russian research centre and wiped more that 2 petabytes of data.

The Main Directorate of Intelligence of the Ministry of Defence of Ukraine, HUR, has announced the success in breaching Russia’s Far Eastern Research Center for Space Hydrometeorology, or Planeta. Understanding that news of state-sponsored attacks against combatants during wartime must be treated with a certain degree of caution, the cyber attack on Planeta is said to have destroyed 280 servers at a cost of ‘at least $10 million’. The research centre is known to  receive and processes satellite data on behalf of more than 50 Russian state entities, including the Ministry of War.

Perhaps for obvious reasons there are no details of how the attack was carried out; this kind of detail will likely emerge later, but the Ukrainian report also claimed that recovery of the lost data would not be possible.

Once again this is not a ‘typical’ example of a cyber attack or data breach. Motives are different and the target was different. It is also possible that the techniques used were radically different too, since Ukraine is being assisted by friendly states such as the US and the UK in its cyberwarfare activities.

IPL Consulting: >60TB of data allegedly destroyed in Ukrainian cyber attack

The second largest breach globally, by amount of data affected, in the first half of 2024 is also related to the Ukraine war. It was announced via Telegram:

‘The Main Directorate of Intelligence of the Ministry of Defense of Ukraine informs about another successful cyber attack on Russia — the entire IT infrastructure of the IPL Consulting company, which specialized in the implementation of information systems in Russian industry, was destroyed. The specified company presented itself as one of the most modern Russian enterprises, which provided assistance in the implementation of information systems to institutions engaged in design, production of automotive and aviation components, heavy engineering, production of equipment and devices, in particular in the interests of the Russian defense-industrial complex.

The devastating attack against IPL Consulting was carried out by GUR specialists, who penetrated the company's internal network and destroyed its entire IT infrastructure of more than 60 terabytes, dozens of servers and databases. The cost of the digital array of data lost by Russia is being calculated. In the conditions of ongoing sanctions pressure against Russia, the damage inflicted on the enemy is extremely painful. In addition, dozens of Russian companies that work for the "defense" of the aggressor state will suffer.’

This attack seems to have been confirmed by various ‘intelligence sources’ although the media seems to have relied on reports from Ukraine’s Main Intelligence Directorate (HUR).

This is another incident of which we may never know the full details, but reminds us again of the new world in which we live.

Size isn’t everything

So the four largest incidents, by amount of data involved, in the first 6 months of 2024 on two continents, have turned out to not involve cybercrime. Admittedly the Discord/Spy.Pet incident was motivated by profit, but it may not have actually broken any laws.

When one gets into the body of these catalogues of security failings however, there are more familiar scenarios. For example between early February and early March the French national unemployment agency, France Travail, was attacked. Data on some 43 million people was obtained, which included details like:

• Full name

• Date and place of birth

• Social security number (NIR)

• France Travail identifier

• Email address

• Postal address

• Telephone number

France Travail did note that no passwords or banking details were exposed but since most similar data breaches find their way to dark web sites they are then amalgamated with data from other sources like a jigsaw.

French newspaper Le Figaro reported that attackers posed as Cap Emploi advisors to break in. Cap Emploi is a government agency supporting people with disabilities that works together with France Travail.

According to a prominent ethical hacker, known as SaxX, the four most likely attack vectors were:

• Data scraping from an insider

• A vulnerability exploit

• An unfortunate database export to an exposed or insecure cloud service

• A third-party compromise

Precise details of the methods are still not known. This is not the first problem with France Travail (known previously as Pole Emploi until late 2023) as they were a victim of the MOVEit supply chain attack last year.

CCP gets Apple to modify AirDrop

Now for a security item that is not a major hack but is of interest nonetheless. A Chinese state-backed research institute claimed to have hacked the Apple AirDrop feature to enable identification of the phone number and email address of senders. This is significant as AirDrop has been used regularly to coordinate protests in China. AirDrop can be used to send something to ‘everyone’ in range. Along with whatever is being deliberately sent by someone there are hashes of the sender’s phone number and email address that are sent along with it. Since telephone numbers have limited variability, are the same length and are made up of only numbers, it is feasible to pre-hash all possible numbers and then perform a simple lookup when decoding a hash of something you want to trace the source of.

To do this it would be necessary to have physical access to the device, so for the case of China’s authorities wishing to clamp down on organised protesters it presents a problem. The Chinese Communist Party (CCP) had already approached Apple about this problem. We can safely assume that as a direct result of this Apple modified AirDrop so that the ‘everybody’ option could only be activated for 10 minutes at a time. We may also reasonably assume that this Chinese research is aimed at discouraging protesters from using the AirDrop method in case they can be traced by the authorities.

FBI takes down Russian botnet

A botnet being run by the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU) has been taken down by the FBI in an Operation called Dying Ember. It is thought that the original botnet was created by a cybercrime gang and then obtained by the GRU. It made use of the Moobot malware, installed on around 1,000 Ubiquiti routers. It is believed that the original infections were possible through use of default passwords on the routers. Previously the Moobot malware had been used for Distributed Denial of Service (DDoS) attacks but in this case a variety of exploit packages and scripts were found. This appears to have been a more sophisticated, planned use for these exploited routers, likely state-sponsored and targeting specific companies of interest.

This is the second significant botnet taken down this year after the DOJ closed down the KV botnet, set up by China’s Volt Typhoon group. This botnet was attempting to target Critical National Infrastructure (CNI) — sites like energy systems, satellite and communications installations. Sophisticated malware has been found, like Pipedream and Incontroller, which is specifically crafted to attack infrastructure targets.

In the case of Pipedream it is believed that the package was developed specifically for use in an armed conflict scenario. It is an attack framework that can be adapted to attack any industrial control system and is not limited by manufacturer. Fortunately to date it has never been used in anger.

For the want of a nail…

Possibly the most significant security issue this year so far, which was thankfully caught before it could fulfil its potential, was the so-called XZ Backdoor. Linux is fundamentally an open source operating system and is developed and maintained by a diverse array of programmers across the world. Each technical area will have a lead maintainer and sometimes several others that contribute code and expertise to that area. Some areas are smaller than others and in the case of the XZ compression code it was maintained by a single developer, Lasse Collin, based in Finland.

What followed was a very patient and sinister social engineering attack on an unsuspecting Lasse Collin. First a mysterious new user appeared on GitHub called Jia Tan. This user began to contribute patches and small coding updates to various open source projects. This gradually built a reputation amongst the community of open source developers. Then he contributed what appeared to be a quality of life improvement to the XZ Utils software. The maintainer saw nothing amiss but then a new person ‘Jigar Kumar’ posted a message welcoming the proposed change but lamenting that the release schedule was so slow that it would be too long until it was available.

This seems now to have been a complete setup to portray Tan as a trustworthy individual. The idea was to have Lasse take Tan on as a co-maintainer for XZ Utils. Another fake account soon joined in the dialogue about the slow roll-out schedule of XZ, ‘Dennis Ens’. Over a period of time these fake accounts kept hassling Lasse until he admitted that he’d been having problems, that this was done for no remuneration and that perhaps Jia Tan might be able to take on the maintainer role. Having begun their social engineering in 2021, in 2022 Jia Tan was finally granted commit access to the XZ Utils repository on GitHub. However, since this was a patient attack no bad code was injected into the repo until a year later.

The reason that a vulnerability in this obscure compression code might be significant is that it is used by OpenSSH, the open source version of the popular command line, remote access software popular with system admins. This means malicious code in XZ could allow access through OpenSSH to a system and with root privileges. It was version 5.6.0 of XZ Utils, published on the 24th February that contained the malicious code.

Gradually this polluted version was picked up in the development releases of some major Linux distributions. These development, or alpha/beta, releases are generally only used by other developers and not deployed to production systems. One such developer, Andres Freund, working for Microsoft, was investigating issues on a new Debian system where SSH logins were taking much longer than usual and causing errors in other monitoring software. He discovered that SSH logins were taking half a second longer in this new version. This caused him to investigate the build of this new version and he discovered that as part of the build script the malicious binaries were added from a ‘test’ directory in the repository. This means they were not part of the source in the repo and users would not have expected additional code to be added at build time. Usually additional files used for builds would be confined to configuration files.

Andres posted about what he had found and caused a major storm in the online world. Anyone that had actually rolled out the infected version of XZ Utils quickly rolled back to the previous version and focus switched to Jia Tan and any code he had ever written. Whether there actually is a someone called Jia Tan is still an open question and one that will be investigated much further, you can be sure of that.

This is an example of a supply-chain attack as it is not directed at a single target but rather made part of software that is used widely and inserted at source. The technique and the patience shown by the attacker(s) suggests a nation-state actor, but this is unconfirmed so far. It highlights the levels of vigilance required to properly protect systems which we rely on. It also highlights the subtlety available to determined attackers, making use of technical vulnerabilities along with careful social engineering and the selection of a potentially vulnerable individual.  In case of doubt this incident garnered CVE-2024-3094 and a criticality score of 10 (out of 10). Had it gone unnoticed it would have allowed any bad actor with the appropriate key to inject malicious code, executing as root, into any online Linux host.

source: https://www.bcs.org/articles-opinion-and-research/the-biggest-cyber-attacks-of-2024