North Korean hackers from Lazarus Group exploited a zero-day vulnerability in Google Chrome to target cryptocurrency investors with…

North Korean hackers from Lazarus Group exploited a zero-day vulnerability in Google Chrome to target cryptocurrency investors with a deceptive and fake NFT game. The attackers use social engineering and malicious software to steal sensitive data and potentially deploy further malware.

The infamous North Korean hacking group, Lazarus Group, has launched a sophisticated attack campaign targeting cryptocurrency investors. This campaign, uncovered by Kaspersky researchers, involves a multi-layered attack chain that leverages social engineering, a fake game website, and a zero-day exploit in Google Chrome.

According to the report, Kaspersky Total Security discovered a new attack chain in May 2024 targeting an unnamed Russian national’s personal computer using the Manuscrypt backdoor. 

Kaspersky researchers Boris Larin and Vasily Berdnikov estimate that the campaign started in February 2024. Delving deeper into the attack researchers found that the attackers have created a website called “detankzonecom” that appears to be a legitimate platform for a “DeFiTankZone” game.

This game supposedly combines Decentralized Finance (DeFi) elements with Non-Fungible Tokens (NFTs) within a Multiplayer Online Battle Arena (MOBA) setting. The website even features a downloadable trial version, further enhancing the illusion of legitimacy. However, beneath the surface lies a malicious trap. 

The fake NFA game site and the hidden exploit loader (Via Kaspersky)

“Under the hood, this website had a hidden script that ran in the user’s Google Chrome browser, launching a zero-day exploit and giving the attackers complete control over the victim’s PC,” researchers wrote.

The exploit contains code for two vulnerabilities: one allowing attackers to access the entire address space of the Chrome process from JavaScript (CVE-2024-4947) and the second allows bypassing the V8 sandbox to access memory outside the bounds of the register array. Google patched CVE-2024-4947, a type confusion bug in the V8 JavaScript and WebAssembly engine, in March 2024, but it’s unclear if the attackers discovered it earlier and weaponized it as a zero-day or exploited it as an N-day vulnerability.

An n-day vulnerability refers to a security flaw or weakness that has already been discovered, publicly disclosed, and typically patched or mitigated by the software vendor. The term “n-day” indicates that the vulnerability has been known for “n” days, where n represents the number of days since the vulnerability was first disclosed or patched.

Following successful exploitation, the attackers deploy a custom script (validator) to gather system information and determine if the infected device holds any valuable assets worth further exploitation. The specific payload delivered after this stage remains unknown.  

In this campaign, Lazarus has targeted influential figures in the cryptocurrency space, leveraging social media platforms like X (formerly Twitter) and LinkedIn. They established a social media presence with multiple accounts on X, actively promoting the fake game, and employed generative AI and graphic designers to create high-quality promotional content for the DeTankZone game. Additionally, the group sent specially crafted emails to individuals of interest, posing as blockchain companies or game developers seeking investment opportunities.

The DeTankZone website itself appears to be built upon the stolen source code of a legitimate blockchain game called DeFiTankLand (DFTL). This game experienced a security breach in March 2024, leading to the theft of $20,000 worth of cryptocurrency.

While the developers suspected an insider, Kaspersky researchers believe Lazarus Group might be responsible for both the theft and the repurposing of the stolen source code for their malicious campaign.  

This campaign highlights the evolving tactics of the Lazarus Group. It’s crucial to be wary of unsolicited investment opportunities, especially those involving downloadable game clients or suspicious social media promotions. Additionally, keeping browser software like Chrome updated with the latest security patches is essential to mitigate the risk of zero-day exploits.  

1.  **How Bad is the North Korean Cyber Threat?**
2.  **Feds Bust N. Korean Identity Theft Ring Targeting US Firms**
3.  **North Korean Hackers Deploy Linux FASTCash ATM Malware**
4.  **Fake North Korean IT Workers Infiltrate Firms, Demand Ransom**
5.  **Nexera DeFi Protocol Hacked: $1.8M Stolen in Smart Contract Exploit**

Lazarus Group Exploits Chrome 0-Day for Crypto with Fake NFT Game

Cybersecurity researchers have discovered an advanced version of the Qilin ransomware sporting increased sophistication and tactics to evade detection.
The new variant is being tracked by cybersecurity firm Halcyon under the moniker Qilin.B.
"Notably, Qilin.B now supports AES-256-CTR encryption for systems with AESNI capabilities, while still retaining Chacha20 for systems that lack this support

Cybersecurity researchers have discovered an advanced version of the Qilin ransomware sporting increased sophistication and tactics to evade detection.

The new variant is being tracked by cybersecurity firm Halcyon under the moniker Qilin.B.

"Notably, Qilin.B now supports AES-256-CTR encryption for systems with AESNI capabilities, while still retaining Chacha20 for systems that lack this support," the Halcyon Research Team said in a report shared with The Hacker News.

"Additionally, RSA-4096 with OAEP padding is used to safeguard encryption keys, making file decryption without the attacker's private key or captured seed values impossible."

Qilin, also known as Agenda, first came to the attention of the cybersecurity community in July/August 2022, with initial versions written in Golang before switching to Rust.

A May 2023 report from Group-IB revealed that the ransomware-as-a-service (RaaS) scheme allows its affiliates to anywhere between 80% to 85% of each ransom payment after it infiltrates the group and manages to strike a conversation with a Qilin recruiter.

Recent attacks linked to the ransomware operation have stolen credentials stored in Google Chrome browsers on a small set of compromised endpoints, signaling a departure of sorts from typical double extortion attacks.

Qilin.B samples analyzed by Halcyon show that it builds on older iterations with additional encryption capabilities and improved operational tactics.

This includes the use of AES-256-CTR or Chacha20 for encryption, in addition to taking steps to resist analysis and detection by terminating services associated with security tools, continuously clearing Windows Event Logs, and deleting itself.

It also packs in features to kill processes linked to backup and virtualization services like Veeam, SQL, and SAP, and delete volume shadow copies, thereby complicating recovery efforts.

"Qilin.B's combination of enhanced encryption mechanisms, effective defense evasion tactics, and persistent disruption of backup systems marks it as a particularly dangerous ransomware variant," Halcyon said.

The pernicious and persistent nature of the threat posed by ransomware is evidenced in the ongoing evolutionary tactics demonstrated by ransomware groups.

This is exemplified by the discovery of a new Rust-based toolset that has been used to deliver the nascent Embargo ransomware, but not before terminating endpoint detection and response (EDR) solutions installed on the host using the Bring Your Own Vulnerable Driver (BYOVD) technique.

Both the EDR killer, codenamed MS4Killer by ESET owing to its similarities to the open-source s4killer tool, and the ransomware is executed by means of a malicious loader referred to as MDeployer.

"MDeployer is the main malicious loader Embargo tries to deploy onto machines in the compromised network – it facilitates the rest of the attack, resulting in ransomware execution and file encryption," researchers Jan Holman and Tomáš Zvara said. "MS4Killer is expected to run indefinitely."

"Both MDeployer and MS4Killer are written in Rust. The same is true for the ransomware payload, suggesting Rust is the go-to language for the group's developers."

According to data shared by Microsoft, 389 U.S. healthcare institutions were hit by ransomware attacks this fiscal year, costing them up to $900,000 per day due to downtime. Some of the ransomware gangs known for striking hospitals include Lace Tempest, Sangria Tempest, Cadenza Tempest, and Vanilla Tempest.

"Out of the 99 healthcare organizations that admitted to paying the ransom and disclosed the ransom paid, the median payment was $1.5 million, and the average payment was $4.4 million," the tech giant said.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

New Qilin.B Ransomware Variant Emerges with Improved Encryption and Evasion Tactics

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a now-patched security flaw in Google Chrome to seize control of infected devices.
Cybersecurity vendor Kaspersky said it discovered a novel attack chain in May 2024 that targeted the personal computer of an unnamed Russian national with the Manuscrypt backdoor.
This entails triggering the

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a now-patched security flaw in Google Chrome to seize control of infected devices.

Cybersecurity vendor Kaspersky said it discovered a novel attack chain in May 2024 that targeted the personal computer of an unnamed Russian national with the Manuscrypt backdoor.

This entails triggering the zero-day exploit simply upon visiting a fake game website ("detankzone\[.\]com") that was aimed at the individuals in the cryptocurrency sector. The campaign is estimated to have commenced in February 2024.

"On the surface, this website resembled a professionally designed product page for a decentralized finance (DeFi) NFT-based (non-fungible token) multiplayer online battle arena (MOBA) tank game, inviting users to download a trial version," Kaspersky researchers Boris Larin and Vasily Berdnikov said.

"But that was just a disguise. Under the hood, this website had a hidden script that ran in the user's Google Chrome browser, launching a zero-day exploit and giving the attackers complete control over the victim's PC."

The vulnerability in question is CVE-2024-4947, a type confusion bug in the V8 JavaScript and WebAssembly engine that Google patched in mid-May 2024.

The use of a malicious tank game (DeTankWar, DeFiTankWar, DeTankZone, or TankWarsZone) as a conduit to deliver malware is a tactic that Microsoft has attributed to another North Korean threat activity cluster dubbed Moonstone Sleet.

These attacks are carried out by approaching prospective targets through email or messaging platforms, tricking them into installing the game by posing as a blockchain company or a game developer seeking investment opportunities.

Kaspersky's latest findings add another piece to the attack puzzle, highlighting the role played by the zero-day browser exploit in the campaign.

Specifically, the exploit contains code for two vulnerabilities: the first is used to give attackers read and write access to the entire address space of the Chrome process from the JavaScript (CVE-2024-4947), and the second is abused to get around the V8 sandbox.

"The \[second\] vulnerability is that the virtual machine has a fixed number of registers and a dedicated array for storing them, but the register indexes are decoded from the instruction bodies and are not checked," the researchers explained. "This allows attackers to access the memory outside the bounds of the register array."

The V8 sandbox bypass was patched by Google in March 2024 following a bug report that was submitted on March 20, 2024. That said, it's currently not known if the attackers discovered it earlier and weaponized it as a zero-day, or if it was exploited as an N-day vulnerability.

Successful exploitation is followed by the threat actor running a validator that takes the form of a shellcode responsible for gathering system information, which is then used to determine if the machine is valuable enough to conduct further post-exploitation actions. The exact payload delivered after this stage is currently unknown.

"What never ceases to impress us is how much effort Lazarus APT puts into their social engineering campaigns," the Russian company said, pointing out the threat actor's pattern of contacting influential figures in the cryptocurrency space to help them promote their malicious website.

"For several months, the attackers were building their social media presence, regularly making posts on X (formerly Twitter) from multiple accounts and promoting their game with content produced by generative AI and graphic designers."

The attacker's activity has been observed across X and LinkedIn, not to mention the specially-crafted websites and email messages sent to targets of interest.

The website is also designed to lure visitors into downloading a ZIP archive ("detankzone.zip") that, once launched, is a fully functional downloadable game that requires player registration, but also harbors code to launch a custom loader codenamed YouieLoad, as previously detailed by Microsoft.

What's more, it's believed that the Lazarus Group stole the source code for the game from a legitimate blockchain play-to-earn (P2E) game named DeFiTankLand (DFTL), which suffered a hack of its own in March 2024, leading to the theft of $20,000 worth of DFTL2 coins.

Although the project developers blamed an insider for the breach, Kaspersky suspects that the Lazarus Group was behind it, and that they stole the game's source code alongside the DFTL2 coins and repurposed it to advance their goals.

"Lazarus is one of the most active and sophisticated APT actors, and financial gain remains one of their top motivations," the researchers said.

"The attackers' tactics are evolving and they're constantly coming up with new, complex social engineering schemes. Lazarus has already successfully started using generative AI, and we predict that they will come up with even more elaborate attacks using it."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Lazarus Group Exploits Google Chrome Vulnerability to Control Infected Devices

The North Korean actor is going after cryptocurrency investors worldwide leveraging a genuine-looking game site and AI-generated content and images.

Source: MAHATHIR MOHD YASIN via Shutterstock

North Korea's infamous Lazarus Group is using a well-designed fake game website, a now-patched Chrome zero-day bug, professional LinkedIn accounts, AI-generated images, and other tricks to try and steal from cryptocurrency users worldwide.

The group appears to have launched the elaborate campaign in February and has since used multiple accounts on X and tricked influential figures in the cryptocurrency space to promote their malware-infected crypto game site.

**Elaborate Campaign**

"Over the years, we have uncovered many \[Lazarus\] attacks on the cryptocurrency industry, and one thing is certain: these attacks are not going away," said researchers at Kaspersky, after discovering the latest campaign while investigating a recent malware infection. "Lazarus has already successfully started using generative AI, and we predict that they will come up with even more elaborate attacks using it," the security vendor noted.

The state-sponsored Lazarus group may not quite be a recognizable name yet, but it is easily among the most prolific and dangerous cyber threat actors in operation. Since making headlines with an attack on Sony Pictures back in 2014, Lazarus — and subgroups such as Andariel and Bluenoroff — have figured in countless notorious security incidents. These have included the WannaCry ransomware outbreak, the $81 million heist at Bank of Bangladesh, and attempts to steal COVID-vaccine-related secrets from major pharmaceutical companies during the height of the pandemic.

Analysts believe that many of the group's financially motivated attacks, including those involving ransomware, card-skimming, and cryptocurrency users, are really attempts to generate revenue for the money-strapped North Korean government's missile program.

In the latest campaign the group appears to have refined some of the social engineering tricks employed in past campaigns. Central to the new scam is detankzone dot-com, a professionally designed product page that invites visitors to download an NFT-based multiplayer online tank game. Kaspersky researchers found the game to be well designed and functional, but only because Lazarus actors had stolen the source code of a legitimate game to build it.

**A Chrome Zero-Day and a Second Bug**

Kaspersky found the website to contain exploit code for two Chrome vulnerabilities. One of them, tracked as CVE-2024-4947, was a previously unknown zero-day bug in Chrome's V8 browser engine. It gave the attackers a way to execute arbitrary code inside a browser sandbox via a specially crafted HTML page. Google addressed the vulnerability in May after Kaspersky reported the flaw to the company.

The other Chrome vulnerability that Kaspersky observed in the latest Lazarus Group exploit is that it does not appear to have a formal identifier. It gave the attackers a way to escape the Chrome V8 sandbox entirely and gain full access to the system. The threat actor used that access to deploy shellcode for collecting information on the compromised system before deciding whether to deploy further malicious payloads on the compromised system, including a backdoor called Manuscrypt.

What makes the campaign noteworthy is the effort that Lazarus Group actors appear to have put into its social engineering angle. "They focused on building a sense of trust to maximize the campaign's effectiveness, designing details to make the promotional activities appear as genuine as possible," Kaspersky researchers Boris Larin and Vasily Berdnikov wrote. They used multiple fake accounts to promote their site via X and LinkedIn along AI-generated content and images to create an illusion of authenticity around their fake game site.

"The attackers also attempted to engage cryptocurrency influencers for further promotion, leveraging their social media presence not only to distribute the threat but also to target their crypto accounts directly," Larin and Berdnikov wrote.

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Lazarus Group Exploits Chrome Zero-Day in Latest Campaign

New variants of a banking malware called Grandoreiro have been found to adopt new tactics in an effort to bypass anti-fraud measures, indicating that the malicious software is continuing to be actively developed despite law enforcement efforts to crack down on the operation.
"Only part of this gang was arrested: the remaining operators behind Grandoreiro continue attacking users all over the

New variants of a banking malware called Grandoreiro have been found to adopt new tactics in an effort to bypass anti-fraud measures, indicating that the malicious software is continuing to be actively developed despite law enforcement efforts to crack down on the operation.

"Only part of this gang was arrested: the remaining operators behind Grandoreiro continue attacking users all over the world, further developing new malware and establishing new infrastructure," Kaspersky said in an analysis published Tuesday.

Some of the other freshly incorporated tricks include the use of a domain generation algorithm (DGA) for command-and-control (C2) communications, ciphertext stealing (CTS) encryption, and mouse tracking. Also observed are "lighter, local versions" that are specifically focused on targeting banking customers in Mexico.

Grandoreiro, active since 2016, has consistently evolved over time, taking efforts to stay undetected, while also widening its geographic scope to Latin America and Europe. It's capable of stealing credentials for 1,700 financial institutions, located in 45 countries and territories.

It's said to operate under the malware-as-a-service (MaaS) model, although evidence points to it being only offered to select cybercriminals and trusted partners.

One of the most significant developments this year concerning Grandoreiro is the arrests of some of the group's members, an event that has led to the fragmentation of the malware's Delphi codebase.

"This discovery is supported by the existence of two distinct codebases in simultaneous campaigns: newer samples featuring updated code, and older samples which rely on the legacy codebase, now targeting only users in Mexico — customers of around 30 banks," Kaspersky said.

Grandoreiro is primarily distributed by means of a phishing email, and to a lesser extent, through malicious ads served on Google. The first stage is a ZIP file, which, in turn, contains a legitimate file and an MSI loader that's responsible for downloading and launching the malware.

Campaigns observed in 2023 have been found to leverage extremely large portable executables with a file size of 390 MB by masquerading as AMD External Data SSD drivers to bypass sandboxes and fly under the radar.

The banking malware comes equipped with features to gather host information and IP address location data. It also extracts the username and checks if it contains the strings "John" or "WORK," and if so, halts its execution.

"Grandoreiro searches for anti-malware solutions such as AVAST, Bitdefender, Nod32, Kaspersky, McAfee, Windows Defender, Sophos, Virus Free, Adaware, Symantec, Tencent, Avira, ActiveScan, and CrowdStrike," the company said. "It also looks for banking security software, such as Topaz OFD and Trusteer."

Another notable function of the malware is to check for the presence of certain web browsers, email clients, VPN, and cloud storage applications on the system and monitor user activity across those apps. Furthermore, it can act as a clipper to reroute cryptocurrency transactions to wallets under the threat actor's control.

Newer attack chains detected in the aftermath of the arrests this year include a CAPTCHA barrier prior to the execution of the main payload as a way to get around automatic analysis.

The latest version of Grandoreiro has also received significant updates, including the ability to self-update, log keystrokes, select the country for listing victims, detect banking security solutions, use Outlook to send spam emails and monitor Outlook emails for specific keywords.

It's also equipped to capture mouse movements, signaling an attempt to mimic user behavior and trick anti-fraud systems into identifying the activity as legitimate.

"This discovery highlights the continuous evolution of malware like Grandoreiro, where attackers are increasingly incorporating tactics designed to counter modern security solutions that rely on behavioral biometrics and machine learning," the researchers said.

Once the credentials are obtained, the threat actors cash out the funds to accounts belonging to local money mules by means of transfer apps, cryptocurrency, or gift cards, or an ATM. The mules are identified using Telegram channels, paying them $200 to $500 per day.

Remote access to the victim machine is facilitated using a Delphi-based tool named Operator that displays a list of victims whenever they begin browsing a targeted financial institution website.

"The threat actors behind the Grandoreiro banking malware are continuously evolving their tactics and malware to successfully carry out attacks against their targets and evade security solutions," Kaspersky said.

"Brazilian banking trojans are already an international threat; they're filling the gaps left by Eastern European gangs who have migrated into ransomware."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

New Grandoreiro Banking Malware Variants Emerge with Advanced Tactics to Evade Detection

Tax preparation firms shared user information with Google and Meta without proper consent by using tracking pixels

Four tax preparation software companies failed to comply with government rules that require the sharing of tax-related info to be done only with specific disclosures and full tax-payer consent, according to an audit released by the Treasure Inspector General for Tax Administration (TIGTA) in the United States.

> “According to Treasury Regulation § 301.7216-3, tax return information may not be used or disclosed except as specifically permitted or when the taxpayer provides consent.”

The Internal Revenue Service (IRS) partners with tax professionals and other entities that assist taxpayers in meeting their tax obligations. Before partnering with these professionals and entities, the IRS conducts suitability checks. But the IRS does not have awareness of the full scope of information that an online provider routinely collects, beyond what is filed with the IRS, or shared with third parties.

Further, the guidance for obtaining taxpayer consent to use or disclose taxpayer information does not specifically address the use of pixels, such as those used by Facebook and Google to track information on a website.

These pixels are basically a piece of code that website owners can place on their website. The pixel collects data that helps businesses track conversions from ads, optimize ads, build target audiences for future ads, and re-market to people that have already taken some kind of action on their website. That’s nice for the advertisers, but the combined information of all these pixels potentially provides the recipients with an almost complete portrait of your browsing behavior.

The audit was performed after TIGTA received a congressional letter raising concerns about the data sharing practices of online tax filing companies. This letter spoke of data sharing methods that used a pixel to capture an individual’s entries on the online tax filing companies’ website, which then sent data entered for the preparation of online tax returns to a third party to focus marketing and advertisement efforts to each user.

In other words, information that is highly regulated was collected and shared outside the rules of those regulations, which could have allowed for invasions of privacy.

TIGTA acknowledged that it shared similar concerns and that it was in the process of conducting a separate but related review.

TIGTA did not disclose the names of the four companies that were the subject of these investigations, but in a follow-up letter from 3 senators and a member of congress they mention TaxSlayer, H&R Block, TaxAct, and Ramsey Solutions.

The review found that the audited companies’ consent statements did not comply with the requirements of Treasury Regulation § 301.7216. Specifically, the consent statements did not clearly identify the intended purpose of the disclosure and the specific recipient(s) of the tax return information.

Based on the results TIGTA advised the IRS to update their revenue procedure to include language that consent statements must identify the purpose of disclosure and specific recipient(s); evaluate whether any updates are needed to the guidance regarding data sharing practices, e.g., the use of pixels; and identify and implement potential solutions that will ensure that online providers comply with the regulatory requirements of taxpayer consent statements.

The IRS has taken actions to address the previously reported deficiencies with the suitability check processes and procedures for tax preparation companies. For example, the IRS:

*   Updated procedures to ensure consistency with initial and continuous suitability checks.
*   Established a consistent adjudication process for applicants with a criminal history.
*   Modified procedures to systemically create cases requiring research and resolution for tax compliance issues.
*   Modified procedures to accept only electronic fingerprint cards.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 After concerns of handing Facebook taxpayer info, four companies found to have improperly shared data 

Popular titles on both Google Play and Apple's App Store include hardcoded and unencrypted AWS and Azure credentials in their codebases or binaries, making them vulnerable to misuse by threat actors.

Source: Aleksia via Alamy Stock Photo

Several widely used mobile apps, some with millions of downloads, expose hardcoded and unencrypted credentials to cloud services within their code bases, researchers from Symantec have found. This potentially allows anyone with access to the app’s binary or source code to extract the credentials to exploit cloud infrastructure for misuse.

Popular apps for both Android and iPhone devices include credentials for either Amazon Web Services (AWS) and Microsoft Azure Blog Storage within their code, Symantec revealed in a blog post this week. And they're found on each device platform’s respective official mobile app store: Google Play and Apple's App Store.

"This dangerous practice means that anyone with access to the app's binary or source code could potentially extract these credentials and misuse them to manipulate or exfiltrate data, leading to severe security breaches," Symantec engineers wrote in the post.

Further, the "widespread nature" of the vulnerabilities across apps for both iOS and Android platforms "underscores the urgent need for a shift towards more secure development practices" when it comes to mobile applications, they added.

Symantec’s research zeroed in on a number of widely distributed mobile applications that included either AWS or Azure credentials in their codebases. In terms of the former, both Android and iOS apps are guilty of credential exposure, while several Android apps expose Azure storage credentials.

Related:SoftwareOne Launches Cloud Competency Centre in Malaysia

For example, an app called The Pic Stitch: Collage Maker found on the Google Play store contains hardcoded AWS production credentials — including the production Amazon S3 bucket name, the read and write access keys, and secret keys — in its codebase, the researchers found. It also reveals staging credentials in some cases.

**iOS Apps With Serious Security Risks**

Meanwhile, three iOS apps examined by Symantec also were found to expose AWS credentials. One called Crumbl, which has more than 3.9 million user ratings and is ranked No. 5 in the Food & Drink category on the Apple App Store, initializes an AWSStaticCredentialsProvider with plaintext credentials. The credentials, which are used to configure AWS services, include both an access key and secret key.

Furthermore, the app also includes another "significant security oversight" by including a WebSocket Secure (WSS) endpoint within its code. This endpoint, part of the Amazon API URL, is hardcoded with an API Gateway that directly connects to the Internet of Things services on AWS.

"Exposing such URLs alongside static credentials makes it easier for attackers to potentially intercept or manipulate communications, leading to unauthorized access to the associated AWS resources," the engineers wrote. Thus, this vulnerable configuration, without proper encryption or obfuscation, "presents a serious risk to the integrity of the application and its backend infrastructure," they noted.

Related:Unmanaged Cloud Credentials Pose Risk to Half of Orgs

Two other iOS apps with hundreds of thousands of App Store ratings also expose AWS credentials by hardcoding them directly within their code; the apps are Eureka: Earn Money for Surveys and Videoshop – Video Editor.

The former allocates an INMAWSCredentials object and initializes it with the access key and secret key, both stored in plaintext and which can be used to log events to AWS, "exposing critical cloud resources to potential attacks," the engineers said.

The latter directly embeds unencrypted AWS credentials in the \[VSAppDelegate setupS3\] method, which means anyone with access to the app's binary could easily extract them. This would give them unauthorized access to the associated S3 buckets and potentially lead to data theft or manipulation.

**Android Apps Expose Azure Credentials**

Similarly, three Android applications expose credentials to Microsoft Azure Blob Storage directly, via either their binaries or codebases, Symantec found.

Related:Cisco Disables DevHub Access After Security Breach

An Indian ride-sharing app, Meru Cabs — which has more than 5 million downloads on Google Play — includes hardcoded Azure credentials within its UploadLogs service by embedding a connection string that includes an account key. "This connection string is used to manage log uploads, exposing critical cloud storage resources to potential abuse," the engineers wrote.

Sulekha Business, another Android app with more than 500,000 downloads, embeds multiple hardcoded Azure credentials used for various purposes — such as adding posts, handling invoices, and storing user profiles — across its codebase.

A third Android app that also has more than 500,000 downloads, ReSound Tinnitus Relief, also hardcodes Azure Blob Storage credentials for managing various assets and sound files, the exposure of which could lead to unauthorized access and data breaches.

**Mitigation Begins With App Development**

Symantec’s findings come a day after the release of a report by Datadog that found that unmanaged credentials that live for too long on a cloud-based network posed a security risk to half of organizations. Indeed, any inadvertent disclosure of credentials to cloud services exposes any organization with network infrastructure, software, or other assets running on them to significant risk, according to Symantec.

A good place to start to mitigate these risks is in the development of applications, where developers should follow best practices for managing sensitive information. They include the use of environment variables to store sensitive credentials so they are loaded at runtime rather than embedded directly in the app's code, according to Symantec.

Developers also should use dedicated secrets management tools, such as AWS Secrets Manager or Azure Key Vault, to securely store and access credentials. If the credentials must be stored in the app, then they should ensure that they use strong encryption algorithms, and decrypt them at runtime as needed.

According to Symantec, another way to protect credentials and also avoid other potential app-development missteps is to integrate automated security-scanning tools into the development pipeline to detect common security flaws early in the development process.

**About the Author**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Mobile Apps With Millions of Downloads Expose Cloud Credentials

The #opentowork hashtag may attract the wrong crowd as criminals target LinkedIn users to steal personal information, or scam them.

Microsoft’s social network for professionals, LinkedIn, is an important platform for job recruiters and seekers alike. It’s also a place where criminals go to find new potential victims.

Like other social media platforms, LinkedIn is no stranger to bots attracted to special keywords and hashtags. Think “I was laid off”, “I’m #opentowork” and similar phrases that can wake up a swarm of bots hungry to scam someone new.

Bots are problematic as they not only create a poor user experience but also present real security risks. Perhaps even more insidious are customized phishing attempts, where fraudulent LinkedIn accounts directly reach out to their victim via the premium InMail feature. In this case, it’s all about harvesting personal information from targets of interest.

In this article, we review recent observations and provide tips for job seekers and users of the platform in general.

**Hungry bots**

Online bots are so common that they transcend every possible industry: advertising, music and concerts, social media, games, and more. There are even companies whose entire business model is to disrupt and contain bots. The impact of bots depends on which point of view you are taking, as it can range from simple nuisance, to opinion swaying, costly fraud, and a lot more in between.

We recently observed fake LinkedIn accounts that prey on those just laid off. Within minutes of a post, dozens of accounts start replying with links or requests to be added as a connection.

The use of certain hashtags was already known to attract bots, and the _#opentowork_ one is no different. Ironically, even a recruiter was previously swamped with similar messages and questioned whether they might have to refrain from ever having to use the hashtag again:

The battle between HR and the bots was featured in a Brian Krebs article from a couple of years ago. While the accounts we saw in the most recent campaign were not labeled as recruiters directly, they often pointed to other profiles that were. In the majority of cases, scammers used the name of real people and their pictures to create new accounts.

It appears their primary goal may be to gain connections by pretending to help a job seeker. This may increase the supposed authenticity of their profile and make it harder to shut them down.

LinkedIn did take action sometime after we witnessed the original spam wave. Many of the accounts indeed disappeared and comments were removed. It’s unclear whether this was a result of user reports, LinkedIn’s own algorithms, or a combination of both.

Fine tuning anti-fraud algorithms requires constant calibration, and isn’t without casualties. Some content creators have been banned due to “false positives”, eroding the trust and dedication they put into the platform.

**You’ve got InMail**

While bots are annoying, they are usually so predictable and noisy that they can be spotted from miles away, especially when they duplicate their own comments on the same post. More dangerous are personalized requests that come directly into a user’s inbox.

It’s the same idea of a fake recruiter, but the profile looks more credible and scammers are using paid accounts. In fact, the ability to send a message to a user who’s not in your circle of contacts, is one of LinkedIn’s feature for going premium, called InMail.

In the image seen above, an alleged Amazon recruiter going by the name “Kay Poppe”, sent a direct message about a unique job opportunity at Amazon Web Services. The so-called recruiter’s profile picture looks to be AI-generated, and the name Kay Poppe vaguely reminds us of “K-pop”, the Korean pop music phenomenon. Perhaps this is a bit of a stretch, but we couldn’t help but think of North Korea’s relentless phishing attempts.

This was not a standard, copy-paste message but rather a carefully crafted one based on the victim’s job profile. The link shortener they used was related to their current position and was the hook to get them to visit a fake LinkedIn page showing a number of documents related to that role. None of the links to the documents actually load what they claim to be, instead they are meant to be a segway to a page hosting a phishing kit.

In this particular instance, this is the Rockstar2FA phishing-as-a-service toolkit used to harvest Google credentials. As more and more people are using two-factor authentication, criminals have come up with their own methods to bypass 2FA. While it is recommended to avoid SMS-based verification and instead use a one-time password (OTP) app, users can still get social engineered into entering the temporary code into a phishing page.

Stealing a Google account is usually only the first step in longer chain leading to a full compromise. Many people use their Google email as a recovery address for a number of other online accounts. This can allow a criminal to reset as many passwords as they can get their hands on before the victim even realizes what’s happened. It’s also not unusual to get locked out of your account and then struggle to regain control of it.

**Fish in a larger pod**

Scammers are notorious for targeting the vulnerable, and one could say that after losing a job you probably feel this way. All too eager to regain employment, you may jump at the first opportunity and engage in a conversation that could end badly.

Many of the bots spamming via comments tie back to some kind of fraud such as the advance-fee scam where you need to pay an up-front fee in order to receive goods or services. Some job offers are also too good to be true, and you could unknowingly participate in illegal activities by helping to funnel and launder money.

The more targeted phishing attempts are dangerous not only for the individual in question but also for the company they work for. This may be the case if you are not actively looking for a new job, and as such compromising you could in turn have further consequences, such as getting an entry point into an entire organization.

Whether you are looking for a job or already have one, you should expect to get contacted by some unknown third-party at some point. Treat every such inquiry with suspicion and caution. Remember that on the internet, not everyone is who they pretend to be.

Also, consider passkeys, a newer form of authentication that was specifically designed to move away from passwords and be less prone to phishing attacks. They rely on a private-public key exchange between a device and the service’s login page removing the need to enter passwords or codes.

If you ever fall victim to a scam, time is of the essence. Immediately:

*   be on the lookout for unusual account changes
*   proactively do a full password sweep
*   reach out to your bank and credit card company
*   inform your contacts who may receive fraudulent messages coming from you

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 LinkedIn bots and spear phishers target job seekers 

The longer we avoid reform, the further behind we'll fall in AI innovation — and the more vulnerable we'll be.

Stephen Kines, Chief Operations Officer, Goldilock

October 23, 2024

5 Min Read

Source: Jochen Tack via Alamy Stock Photo

COMMENTARY

Artificial intelligence (AI) technology has become virtually inescapable, and its growth has kickstarted a worldwide AI arms race. But where the US was once at the forefront, it's quickly losing ground to countries like China, because its energy grid cannot support the breakneck pace of innovation. To remain a global AI leader, the federal government needs to make the grid more secure and resilient by addressing three compounding issues. 

**Growing Energy Demands**

First, data center electricity consumption is expected to triple, from 2.5% of the US total in 2022 to 7.5% by 2030. That's equivalent to the energy consumption of one-third of all US homes. We need to squeeze more power generation out of the energy grid, or it won't be able to meet the demand of AI. At the same time, the US must show the world that this can be done sustainably as it continues working toward its net-zero goals. 

Acknowledging this necessity, executives from OpenAI, Nvidia, Anthropic, and Google met at the White House recently for a Roundtable on US Leadership in AI Infrastructure. Following the gathering, the administration announced several new actions to accelerate public-private collaboration, including plans to launch a new Task Force on AI Data Center Infrastructure to coordinate policy across government. 

Time will tell if these efforts help achieve the energy usage and data center capacity required by AI. In the meantime, there are other challenges to consider.

**Utilities Are the New Frontlines of the Cyber War**

Countries like Russia, China, and Iran have a long history of infiltrating US businesses to steal proprietary technology and data. Today, critical infrastructure has become a primary target for cyberattacks by nation-states engaged in geopolitical conflict, and the impact this can have on the ability of the US to prevail in the AI arms race is huge.  

I've seen the chaos critical infrastructure attacks can cause firsthand through my participation in NATO's Defense Innovation Accelerator for the North Atlantic (DIANA), which is aiming to "provide companies with the resources, networks, and guidance to develop deep technologies to solve critical defense and security challenges." Energy is at the top of its agenda and was highlighted as one of three challenges in 2023. 

Rogan Shimmin, challenge manager at DIANA, calls attention to the fact that "these threats are compounded by a significant lack of cyber literacy in the energy sector, which is leading to continued investment in insecure legacy infrastructure and is scaring industry players away from adopting proper security measures." 

**Growing Threat of Climate Change and Severe Weather**

Malicious actors and adversaries aren't the only players who can compromise networks. Severe weather and the heightened energy demand that often results during these instances can also take down networks, as we saw during the 2021 Texas grid collapse. Plus, there's the ongoing possibility of another solar flare knocking out grids, like this year's auroral storms. 

If we continue with business as usual, our energy grids will remain vulnerable to both physical and cyberattacks at any time. As we saw with SolarWinds and the Colonial Pipeline attack, the damage can be catastrophic, not just impacting energy supply but putting the US's position on the world stage at risk. 

**Assessing Recent Federal Efforts for Energy Resiliency**

Fortunately, the federal government recognizes that energy resilience is a priority and has taken measures to support this. Announced in May, the Federal Energy Regulatory Commission's (FERC's) Order No. 1920 outlines a smart grid approach that's a crucial step in addressing long-term transmission planning needs. However, its passage has been hamstrung by political debate in an election year when action is urgently needed.  

In the same vein, the White House launched a Federal-State Modern Grid Deployment Initiative with commitments from 21 leading states. The goal is to bring states together with federal entities and power sector stakeholders in support of modern grid technologies to enable next-level capacity and throughput. The initiative was launched in tandem with the US Climate Alliance's announcement of "policy, technical, and analytical assistance to help participating members advance state-level efforts to carry out these commitments." 

**Is This Enough? Not Really**

These regulations and state-by-state initiatives are a step in the right direction, but they fall short. As the Modern Grid Deployment Initiative alludes, the US must address its energy demands through a level of smart controls, mainly via dynamic line rating (DLR) systems using intelligent sensors and more widely geographically distributed networks. This technology is fundamental to getting more out of networks, and it should be applied to water and other core sectors as well. However, it requires crossing state lines, which is a political hot potato.  

The US must also reduce its attack surface. While DLR and other modern grid technologies can be revolutionary, they exponentially increase the threat of cyberattacks and create new vectors for malicious actors. We have to develop these technologies with a security-first mindset to give utilities a way to stop attacks in their tracks before they can spread, and get back online quickly through better backup and disaster recovery solutions.  

James Appathurai, acting assistant secretary general for innovation, hybrid, and cyber at NATO, argues the ability to disconnect is one of the main security lessons from the Russia-Ukraine war. Upon Russia's first invasion, Ukraine prioritized improving its cyber resilience by building in air gaps through physical network segmentation so its critical infrastructure could be disconnected from the Internet at critical moments. "\[The Internet of Things\] is great, connecting to the Internet for efficiency is great, but you absolutely must build in the worst-case scenario. Being able to run if you are cyberattacked — to air gap, to run on island mode — is very important." 

The federal government needs to acknowledge this urgency and implement regulations that will ensure a more resilient and secure electrical grid. We must push past the partisan divide, as the longer we avoid reform, the further behind we'll fall in AI innovation, and the more vulnerable we'll be. 

**About the Author**

Chief Operations Officer, Goldilock

Stephen Kines is the chief operations officer (COO) and co-founder of Goldilock. He served in the Canadian military and currently represents Goldilock in NATO on the DIANA program. Stephen is also an international corporate lawyer who has been a general counsel for international law firms, as well as ultra-high net worth individuals and families. His expertise is in technology transactions with a positive-ESG impact.

The US Needs a Better Energy Grid to Win the AI Arms Race

Despite a law enforcement sweep last May, the sophisticated downloader malware is re-emerging.

Source: Antony Cooper via Alamy Stock Photo

Just a few months after Europol launched a full-scale disruption effort against malware botnets, one of its primary targets — a downloader malware called Bumblebee — seems to have staged a revival.

The sophisticated piece of malware has been widely used by cybercriminals to break into corporate networks, and its effectiveness is precisely what drew law enforcement's attention. In May, Europol launched full-scale takedowns of a variety of botnets, including IcedID, Trickbot, Smokeloader, SystemBC and Pickabot, as well as Bumblebee. The multipronged effort, dubbed Operation Endgame, was a splashy and highly publicized action to hunt down and stop cybercriminals hiding in their jurisdiction.

In addition to May's botnet bust-up, Operation Endgame added eight Russian nationals to Europe's list of most wanted fugitives for their alleged roles as developers of the Emotet botnet. By mid-June, Operation Endgame made an arrest: a 28-year-old Ukrainian man accused of working as a developer for Russian ransomware groups Conti and LockBit.

**Bumblebee Takes Flight Again**

The botnet was first identified and named by the Google Threat Analysis Group in March 2022. Since its takedown in May, there hadn't been any sign of Bumblebee, until now. Researchers at Netskope found a new instance of Bumblebee being used in combination with a payload not typically associated with the botnet, indicating this is a new iteration of the malware downloader.

Related:Dark Reading News Desk Live From Black Hat USA 2024

"The infection chain used to deliver the final payload is not new, but this is the first time we have seen it being used by Bumblebee," the Netskope researchers wrote in a recent blog post. "These activities might indicate the resurfacing of Bumblebee in the threat landscape."

Its re-emergence would hardly come as a surprise. Other valuable botnet strains like Emotet have likewise risen from the dead. Though disrupted for a time by law enforcement in 2021, Emotet returned with a vengeance and new functionality.

Bumblebee is known for spreading through a variety of methods, including phishing, malicious advertising, and SEO poisoning, explains Patrick Tiquet, vice president of security and architecture for Keeper Security.

And Bumblebee's latest attack chain is even more difficult for defenders to spot than previous versions, according to Tamir Passi, senior product director at DoControl. "What makes this version particularly concerning is its sophistication," Passi says. "Instead of the noisy, obvious attacks we've seen before, it's using a stealthier approach that makes it harder to detect. The attackers are leveraging legitimate tools like MSI installers — it's basically hiding in plain sight."

Related:Anti-Bot Services Help Cybercrooks Bypass Google 'Red Page'

Scarier still is what happens after Bumblebee gets inside a corporate network, he adds.

"But here's the real kicker — this isn't just about compromising individual machines," Passi says. "Once attackers gain access, they can potentially harvest credentials and access all sorts of corporate resources, including SaaS applications. Think about it — one successful phishing email could lead to widespread access across your entire cloud environment."

With stakes that high, cybersecurity teams need to rely on a healthy combination of user awareness training, a zero-trust cybersecurity model, strong password security, and more, Tiquet advises.

Law enforcement organizations will continue to do what they can to tamp down the effectiveness of large cybercrime operations, but along with enterprise cybersecurity teams, they are up against formidable, highly motivated adversaries.

"The re-emergence of Bumblebee after Operation Endgame demonstrates the adaptability of the group believed to be responsible for its development," says Callie Guenther, senior manager of cyber-threat research at Critical Start. "Despite law enforcement efforts to disrupt their activities, the actors quickly reintroduced Bumblebee, indicating well-prepared contingency plans."

Related:Anonymous Sudan Unmasked as Leader Faces Life in Prison

Tag

#google