Kaspersky Reveals Global Rise in APTs, Hacktivism and Targeted Attacks

In summary:

Cyber Espionage, Hacktivism and APTs

The first quarter of 2024 has witnessed a surge in sophisticated cyberattacks, with nation-state actors and hacktivists expanding their targets and refining their techniques. Kaspersky’s Global Research and Analysis Team (GReAT) has released its quarterly APT activity summary, revealing complex and increasing cybersecurity threats.

Ghosts of the Past, New Tricks in the Present:

The infamous Careto (The Mask in English) APT group, silent since 2013, has reemerged targeting high-profile organizations with advanced tools like “FakeHMP,” “Careto2,” and “Goreto.” Their innovative tactics include leveraging legitimate software like MDaemon email servers and HitmanPro Alert driver for stealthy persistence.

Meanwhile, Gelsemium, known for server-side exploits and webshells, continues to deploy stealthy implants like “SessionManager” and “OwlProxy.” Recent campaigns disguised payloads as font files, targeting Palestinian, Tajikistan, and Kyrgyzstan entities.

Beasts in the Middle East

The Middle East has become a hub of APT activity. A newly discovered campaign dubbed “DuneQuixote” targeted government entities using tampered installers for the legitimate “Total Commander” software. These “droppers” delivered the “CR4T” backdoor, showcasing the group’s sophisticated evasion techniques.

Iran-backed Oilrig APT, previously observed targeting IT service providers, has shifted focus to an internet service provider in the Middle East. The group deployed the .NET-based “SKYCOOK” implant for remote command execution and data theft, along with an autohotkey-based keylogger.

Southeast Asia and the Korean Peninsula

DroppingElephant, an Indian-speaking threat actor (also known as “Patchwork“ or “Chinastrats”) continues to target South Asian entities, utilizing the DISCORD CDN network to deliver the Spyder backdoor and Remcos RAT through malicious .DOC and .LNK files.

North Korean state-sponsored group Kimsuky or SharpTongue has deployed a new Golang-based backdoor dubbed “Durian” through a supply-chain attack targeting South Korean cryptocurrency companies.

Notably, the group leveraged legitimate software exclusive to South Korea for the initial infection vector. Durian’s capabilities include command execution, file download, and exfiltration.

Interestingly, Kimsuky’s use of the “LazyLoad” proxy tool hints at a possible connection or collaboration with the Andariel group (also known as the “Guardians of Peace” APT which was behind the infamous HBO data breach), adding another layer of complexity to the region’s cybersecurity.

Hacktivism on the Rise:

The Israel-Hamas conflict has fueled a wave of hacktivist activity, with groups like SiegedSec launching disruptive attacks and leaking sensitive information. SiegedSec, known for its social justice agenda, has targeted companies, and government infrastructure, and even collaborated with other cybercriminal groups.

Hackread.com reported on some of SiegedSec’s cyber attacks, including the data breach of the Stalkerware app TheTruthSpy, the NATO breach, and the PII data leak of INL (Idaho National Laboratory) employees.

Expanding Targets and Cross-Platform Development:

The Spyrtacus malware, previously targeting individuals in Italy via Android devices, has now evolved to include a Windows variant. Evidence suggests the group may be expanding its operations to other countries in Europe, Africa, and the Middle East, highlighting the growing trend of cross-platform malware development.

Stay Protected!

The first quarter of 2024 shows the dangers of cybersecurity can not be underestimated. While social engineering remains a dominant tactic, APT groups are constantly innovating and expanding their reach.

Organizations and individuals must remain alert, understand their specific threat profiles, and implement proper security measures to mitigate their risks. Another area to focus on is the need for cybersecurity training for employees, especially since many reported cyberattacks occurred through simple phishing scams.