Weekly Cyber Round-up

Telekopye targets tourists via hotel booking scams

ESET researchers observed an expansion in the operations of Telekopye, a Telegram bot used to scam users on online marketplaces. Scammers using Telekopye have now started targeting popular accommodation booking platforms like Booking[.]com and Airbnb to maximise their financial gains. The hotel booking scams started gaining traction in 2024 and have been especially prevalent in the summer holiday season. The new activity ultimately leads to victims being asked for card details for payment, which the scammers harvest to steal money. The researchers also observed improvements being made to the tools and operations used by Telekopye scammers.

Fraudulent North Korean IT workers steal intellectual property for extortion

Secureworks researchers analysed the tactics employed by NICKEL TAPESTRY, who conduct remote IT worker schemes linked to the North Korean government. In some of the schemes, fraudulent workers were observed demanding ransom payments from former employers after gaining insider access. This activity suggests that NICKEL TAPESTRY has expanded its operations to include theft of intellectual property, with the potential for monetary gain through extortion, rather than aiming to maintain consistent employment.

SideWinder APT targets Middle East and Africa with StealerBot implant

Kaspersky researchers identified the SideWinder advanced persistent threat (APT) group expanding its attack operations to target the Middle East and Africa. Targeted sectors include government and military entities, logistics, infrastructure and telecommunications companies, financial institutions, universities, and oil trading companies. SideWinder was also observed employing a new espionage toolkit, dubbed StealerBot, that is currently assessed to be their main post-exploitation tool. As an initial infection vector, SideWinder typically leverages spear phishing emails with attached documents that contain information obtained from public websites. Some of the documents were observed using the remote template injection technique to download an RTF file that is designed to exploit CVE–2017-11882 in Microsoft Office, while others used ZIP files containing a malicious LNK file. StealerBot’s identified plugins enable it to install additional malware, take screenshots, log keystrokes, steal passwords, intercept RDP credential, steal files, start reverse shell, phish Windows credentials, and escalate privileges via bypassing UAC.

Iranian threat actors use brute force attacks to compromise critical infrastructure organisations

On October 16th, 2024, United States, Canadian, and Australian authorities released a joint advisory warning that Iranian threat actors are using brute force attacks and other techniques to compromise organisations across multiple critical infrastructure sectors. The threat actors likely aim to obtain credentials and information that can be sold to other actors as a means of gaining initial access or conducting additional malicious activity. Targeted sectors include healthcare and public healthcare, government, information technology, engineering, and energy. Threat actors begin with reconnaissance operations to gather victim identity information and later gain persistent access to victim networks via brute force attacks such as password spraying or multifactor authentication push bombing. After gaining access, the actors use open-source tools and methodologies, such as living off the land techniques, to gather more credentials, escalate privileges, and gain information about the target’s systems and network.