Weekly Cyber Round-up

Kimsuky targets South Korean businesses with DurianBeacon and SmallTiger malware 

Since November 2023, ASEC researchers observed an ongoing Kimsuky campaign targeting South Korean businesses, including defense contractors, automobile part manufacturers, and semiconductor manufacturers. While the campaign initially delivered Andariel’s backdoor, DurianBeacon, the final payload was replaced with SmallTiger in February 2024. The initial infection vector is currently unknown, though the threat actor was observed exploiting internal software update programs of victims during the lateral movement phase. The DurianBeacon attack cases involved the use of MultiRDP and Meterpreter, with DurianBeacon used to maintain control and steal information. The SmallTiger infections included the installation of Mimikatz and ProcDump for credential harvesting, with a change to GitHub for the C2 server observed in May 2024.

Sapphire Werewolf targets Russian industries with Amethyst stealer

Since March 2024, BI[.]ZONE researchers have observed an activity cluster, dubbed Sapphire Werewolf, that has conducted over 300 attacks using a SapphireStealer variant, dubbed Amethyst. Amethyst targets browser data, Telegram configuration files, PowerShell logs, and FileZilla and SSH configuration files. The activity cluster has targeted the Russian education, manufacturing, IT, defense, and aerospace engineering sectors. The researchers assess with medium confidence that phishing emails with T[.]LY links are used to deliver Amethyst. Various lures were identified being used alongside decoy documents, including an enforcement order, a Central Election Committee leaflet, and a decree from the President of Russia.

DarkPeony ControlPlug campaign abuses MMC files to deliver PlugX malware 

NTT Security Holdings researchers identified a DarkPeony campaign, dubbed Operation ControlPlug, that abuses Microsoft Management Console (MMC) files to deliver PlugX malware. The attack specifically exploits the Control Taskpad feature to execute arbitrary commands, aiming to trick users into clicking links by manipulating the appearance settings within the MMC files. The campaign targets military and government organisations in Myanmar, the Philippines, Mongolia, and Serbia. The attack chain begins when the MMC file is opened, presenting a malicious link which triggers a PowerShell script once clicked.

Sticky Werewolf extends targeting to aviation sector

Morphisec researchers observed a new campaign by the threat actor, Sticky Werewolf, targeting the aviation industry with phishing emails purporting to come from the First Deputy General Director of the Moscow-based company, AO OKB Kristall. Rather than using malicious links within the emails, the latest campaign involves archive files containing LNK files that redirect to a payload stored on WebDAV servers. Among the observed payloads were Rhadamanthys Stealer and Ozone RAT. Based on targeting and geopolitical context, Sticky Werewolf is suspected to have links to a pro-Ukrainian cyberespionage group or hacktivists.