Spotlight on APT41

APT41 is a Chinese actor group, targeting mainly organizations in the video game industry. Researchers at FireEye have released a comprehensive report tracking the group's activity since 2014, and have proposed evidence linking the group to two personas based on DNS registratiion information as well as online activity times.

Recommendations

Consider enabling the Cyber Chatter rule in order to monitor activity related to this threat
Ensure defensive systems are up to date with the latest detection
Blacklist network infrastructure associated with this campaign
Remain alert to potential phishing attacks on social media, email, and other platforms

Details

APT41 is a Chinese espionage and cybercrime group, with activity dating back to 2014. Although historically, the group has targeted the video game industry, in recent years, targets have shifted to include the telecom, healthcare, education, and high-tech industries. Attacks against the video game industry are generally financially motivated for the group. Often, the group will include backdoors with legitimate software. One such example is the case of the Infestation and PointBlank game compromises. Both games were injected with CRACKSHOT, a dropper used to download and execute files directly in memory.

FireEye has attributed activity associated with APT41 to Chinese individuals working on behalf of the state. Two individuals have been identified, using monikers Zhang Xuguang and Wolfzhi that have been linked to the group based on time of activity, amongst other things. Both individuals can be linked to APT41 via email and domain registration. Many domains utilized in APT41 campaigns were registered to emails associated with these individuals. This registration information also included Chinese location information and phone numbers. Many other domains registered to these emails are spoofing legitimate gaming companies - which is often seen utilized in the group's attacks.

Breaking News - 08.07.2019

Sephora’s Online Customers Suffer Data Breach

Makeup retailer Sephora has suffered a data breach, with 3.7 million customer records exposed. These records are of customers in Hong Kong, Singapore, Thailand, Indonesia, Phillipines, Malaysia, Australia, and New Zealand. No credit card information has been compromised. This breach comes in the wake of the recent breaches of an additional 10 French companies.

See the full report here: https://www.cisomag.com/sephoras-online-customers-suffer-data-breach/

Smominru hijacks half a million PCs to mine cryptocurrency, steals access data for Dark Web sale

A new Monero miner, called Smominru, has managed to infect over 500,000 machines. This malware mainly targets victims in the Asia Pacific.

See the full report here: https://www.zdnet.com/article/new-cryptojacking-campaign-strikes-half-a-million-pcs/

New Windows malware can also brute-force WordPress websites

A new malware family is making the rounds. Dubbed Clipsa, this malware seeks to infect Windows devices, then scans for cryptocurrency-related files, and uses these files to hijack cryptowallets. The malware also launches brute-force attacks againsty WordPress sites, likely seeking to steal sensitive information from breached sites.

See the full report here: https://www.zdnet.com/article/new-windows-malware-can-also-brute-force-wordpress-websites/

Binance KYC Data Leak — Crypto Exchange Sets $290,000 Bounty On Blackmailer

Binance, the world's largest cryptocurrency exchange, has been hit with a ransomware attack. The ransom demand is bitcoin currently valued at a shocking $3.5 million USD. The attacker has purportedly started a Telegram group, where ID documents for Binance customers have been released. At this time, Binance has refused to pay the ransom demand, and has released a statement. Binance claims "images posted to the attacker's Telegram group lacks the digital watermark the exchange uses for its internal information, adding doubts about its authenticity."

See the full report here: https://thehackernews.com/2019/08/binance-kyc-data-leak.html

LokiBot malware now hides its source code in image files

In the midst of a spike of malware campaigns utilizing steganography for concealment, LokiBot has begun to utilize the technique. Samples have been identified hiding source code within image files.These images can actually be opened as image files, despite containing code used in the malware's unpacking process, making it difficult for users to detect attacks.

See the full report here: https://www.zdnet.com/article/lokibot-information-stealer-now-hides-malware-in-image-files/