Breach Roundup: Kimsuky Serves Linux Trojan

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, hackers used a Linus backdoor and a Microsoft client management tool; Santander Bank, the Helsinki Education Division, an Australian energy provider and auction house Christie’s were breached; hackers targeted European missions in the Middle East; and Google patched a zero-day flaw.

See Also: Ransomware Response Essential: Fixing Initial Access Vector

.

The North Korean hacking group popularly known as Kimsuky is distributing a Linux backdoor as a software update in a campaign against South Korean targets, said researchers from Symantec’s Threat Hunter Team. The backdoor, Linux.Gomir, is structurally “almost identical” and shares extensive code with a Windows-based backdoor tracked as GoBear, which is linked to Kimsuky.

The Pyongyang threat group has a history of deploying aggressive social engineering tactics against think tanks, governments and journalists to obtain intelligence on how the external world views the Hermit Kingdom. It’s also tracked as Emerald Sleet, APT43, Velvet Chollima and Black Banshee. Symantec calls it Springtail. Sometimes the threat actor gathers intelligence by pretending, in emails, to be interested in Korean peninsular politics and then asking victims to download a backdoor (see: Kimsuky Uses Permissive DMARC Policies to Spoof Emails).

Kimsuky’s latest campaign shows that software packages salted with a Trojan “are now among the most favored infection vectors for North Korean espionage actors,” a Thursday Symantec blog post says. The software it mimics has been “carefully chose to maximize the chances of infecting its intended South Korean-based targets.”

Other malware similar to Linux.Gormir includes Trojans tracked as Troll Stealer and BetaSeed.

A financially motivated threat group is using voice-phishing and a Microsoft client management tool to install Qakbot and Cobalt Strike malware – and ultimately Black Basta ransomware – on victim devices, said researchers from Microsoft Threat Intelligence.

The threat group, which Microsoft tracks as Storm-1811, impersonates IT support or help desk personnel in phone calls to persuade victims to grant access through Microsoft Quick Assist, a remote access tool. Once a user grants access, the hackers download malicious payloads, some of them masquerading as spam filter files, that enable them to install the Qakbot malware, remote management tools such as ScreenConnect and NetSupport Manager, and hacker mainstay Cobalt Strike.

“Storm-1811 leverages their access and performs further hands-on-keyboard activities such as domain enumeration and lateral movement. Storm-1811 then uses PsExec to deploy Black Basta ransomware throughout the network,” the researchers said.

BlackBasta and Qakbot have an association dating to the ransomware group’s first appearance in April 2022. Qakbot is also known as QBot and was on the receiving end of an international law enforcement operation last August. Its operators have since begun reconstructing the botnet (see: Microsoft Patches Zero-Day Exploited by Qakbot).

Spanish bank Santander said Tuesday that unauthorized actors accessed an internal database hosted by a third-party provider. The database contained the personal information of customers of Santander Chile, Spain and Uruguay, as well as that of all current employees and some former employees of the bank.

The bank said it shut down access to the compromised database and put in place fraud prevention controls to protect affected customers, even though the affected database did not store customers’ online banking details, passwords or transaction data. “The bank’s operations and systems are not affected, so customers can continue to transact securely,” it said. The bank has more than 200,000 employees worldwide and close to 20 million customers in Spain and Chile.

Russia cyberespionage group Turla used two previously unknown backdoors to compromise a European ministry of foreign affairs and several of its diplomatic missions abroad, particularly in the Middle East, says a report from Eset Research.

Researchers said the cyberespionage campaign involved Turla using prior access to a domain controller to conduct lateral movement to machines of related institutions in the same network and deploying LunarWeb and LunarMail backdoors at several missions located abroad.

According to Eset, LunarWeb infects servers by using HTTPS for command-and-control communications, and it mimics legitimate requests. LunarMail infects workstations as an Outlook add-in and relies on email for command-and-control communications. Both backdoors use commands hidden in images to avoid detection – a technique researchers refer to as steganography.

Researchers said both backdoors have similar functionality that includes collecting system information, writing files, creating new processes and executing Lua scripts. The difference between them is that LunarWeb exfiltrates information from the system and LunarMail collects information from recipients’ sent email messages.

The U.S. Department of Justice in 2023 disrupted Turla malware operation that infected computers with Snake malware. The FBI said Turla is a unit of Russia’s Federal Security Service. The group is also tracked as Krypton, Venomous Bear and Waterbug.

Australian electricity and energy utility Sumo said an unauthorized third party gained access to a third-party file storage application that gave them access to the data of more than 40,000 customers. The number of affected customers could rise.

“No payment information was accessed in the incident,” Sumo said.

British auction house Christie’s suspended online bidding for its spring art auctions in New York after a cyberattack took down the company’s official website during the weekend. The auction house said its flagship auction event of the year will proceed in person and by phone.

“We apologize that our full website is currently offline. We are looking to resolve this as soon as possible and regret any inconvenience,” the auction house said on a temporary website that listed schedules for upcoming auctions and global helpline numbers. “Christie’s has in place well-established protocols and practices, which are regularly tested, to manage such incidents,” the auction house told the BBC.

The city of Helsinki said Monday that malicious actors exploited a vulnerability in a remote access server to gain access to the personal information of tens of thousands of students and guardians and tens of millions of files stored in network drives.

Malicious actors targeted Helsinki’s education division network on April 30. The available hotfix patch for the vulnerability had not been used, the city said. An investigation into the breach revealed that hackers accessed the data of over 80,000 students and their guardians as well as credentials, personal IDs and addresses of all city personnel.

Helsinki Chief Digital Officer Hannu Heikkinen said the threat actor also accessed content on network drives belonging to the Education Division – including tens of millions of data files, some of which contained sensitive personal information. “These include information about fees (and the grounds thereof) for customers of early childhood education and care, sensitive information about the status of children, such as information requests by student welfare or information about the need of special support and medical certificates regarding the suspension of studies for upper secondary students, as well as the sick leave records of Education Division personnel.”

Google patched an actively exploited zero-day in its V8 JavaScript engine in an emergency fix published Wednesday. The flaw, tracked as CVE-2024-4947, is a type confusion weakness. Google typically discloses little information about flaws in security updates.

Microsoft, which uses Google’s Chromium platform for its Edge browser – it has approximately a 5% market share, according to GlobalStats – said Wednesday it is “actively working on releasing a security fix.”

The vulnerability is the third actively exploited Chrome zero-day that Google has patched in a week. Two Monday updates patched two other such flaws: CVE-2024-4671 and CVE-2024-4761. Each allowed a hacker to escape the Chrome sandbox -i.e., to potentially escape the confines of a single Chrome browser tab.

Other Coverage From Last Week

With reporting by Information Security Media Group’s David Perera in Washington, D.C.