Security researchers discovered a threat actor known as Unfurling Hemlock infecting target systems with up to ten pieces of malware simultaneously. Dubbed a “malware cluster bomb” by researchers, this method involves using one malware sample to spread additional ones on compromised machines. The malware mainly consisted of stealers, such as Redline, RisePro and Mystic Stealer, and loaders such as Amadey and SmokeLoader.
Outpost24’s KrakenLabs, the Cyber Threat Intelligence team, discovered this operation. Their findings reveal that Unfurling Hemlock’s activity dates back to at least February 2023 and employs a unique distribution method. KrakenLabs has identified over 50,000 “cluster bomb” files with distinct characteristics linking them to Unfurling Hemlock.
The attack begins with the execution of a file named ‘WEXTRACT.EXE’, which arrives on target devices through malicious emails or malware loaders that Unfurling Hemlock acquires from other operators. This executable contains nested compressed cabinet files, each level holding a malware sample and another compressed file. As each stage is unpacked, a new malware variant is dropped onto the victim’s machine. The final stage’s extracted files are executed in reverse order, with the most recently extracted malware executed first.
The researchers found that over half of Unfurling Hemlock’s attacks targeted systems in the United States, with significant activity also observed in Germany, Russia, Turkey, India, and Canada.
Evan Dornbush, former NSA cybersecurity expert had this to say:
“KrakenLabs’ report demonstrates why it is critical to support cybersecurity research efforts. The attackers appear to have taken a multitude of known tools and packaged them up in a novel mechanism that could facilitate evasion from defensive technology or, if detected, only be partially caught and removed from infected systems. In other words, things the defensive community thought were “solved” are still able to have harmful impact. This report highlights how both attackers and defenders incrementally improve looking at prior works.”
Organizations and perhaps individuals have one more thing that they can add to the list of things that they need to create defences to stop. Making life hard for overworked teams who are responsible for stopping cyber threats.
TeamViewer Pwned Again
Posted in Commentary with tags TeamViewer on June 29, 2024 by itnerdToday, TeamViewer, a large remote access and control software provider, has confirmed a data breach by the notorious hacker group Midnight Blizzard. The company’s statement confirmed the breach is tied to an employee’s credentials within its Corporate IT environment. Bleeping Computer has more details:
While TeamViewer states there is no evidence that its product environment or customer data has been breached, its massive use in both consumer and corporate environments makes any breach a significant concern as it would provide full access to internal networks.
In 2019, TeamViewer confirmed a 2016 breach linked to Chinese threat actors due to their use of the Winnti backdoor. The company said they did not disclose the breach at the time as data was not stolen in the attack.
Glenn Chisolm, Co-Founder, Obsidian had this to say:
“Identity compromise, which has been a driver in the TeamViewer incident, is a critical component of most breaches we see in customer environments, accounting for over 80% of SaaS breaches. We see TeamViewer deployed by 1-in-3 organizations – so ensuring that the breach is contained is the first big step for the company.
Our advice to customers to minimize identity compromises is to follow 3 crucial steps – a) centralize identity access behind an IdP — often many apps also have local users, and ensuring the right levels of security is much harder in a distributed setting, b) federated access supported with the right levels of MFA to elevate the security, and c) monitor and protect employee accounts, especially administrative accounts, against abnormal behavior — such as can result from spear phishing attacks, AiTM phishing, and more.”
TeamViewer is something that I have been strongly recommending against since their 2016 hack that they only admitted to three years later. This reinforces the fact that if you use TeamViewer, you should strongly consider using another product. Because TeamViewer clearly cannot be trusted.
Leave a comment »