What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-08-14 18:17:06 | EastWind campaign: new CloudSorcerer attacks on government organizations in Russia (lien direct) | #### Targeted Geolocations - Russia #### Targeted Industries - Government Agencies & Services - Information Technology ## Snapshot Researchers at Kapersky identified a targeted cyberattack campaign, named EastWind, that occurred in late July 2024, targeting Russian government organizations and IT companies. ## Description The threat actors utilized phishing emails with malicious shortcut attachments to infect devices, delivering malware that received commands via the Dropbox cloud service. The additional payloads included the VERSION.dll backdoor, GrewApacha RAT used by APT31 (tracked by Microsoft as Violet Typhoon) since 2021, a new version of the CloudSorcerer backdoor, and the PlugY implant, which overlaps with APT27 (tracked by Microsoft as Linen Typhoon) tools. The attackers gained initial access to organizations through spear phishing, sending malicious emails with attached RAR archives containing decoy documents and malicious files. The campaign demonstrated the evolving tactics and techniques employed by threat actors to infiltrate and compromise targeted organizations, emphasizing the ongoing threat of sophisticated cyberattacks targeting government and IT sectors. ## Additional Analysis Kapersky [previously reported](https://securelist.com/cloudsorcerer-new-apt-cloud-actor/113056/) on the CloudSorcerer backdoor and its use in attacks on government organizations in Russia. Used as a cyberespionage tool, the malware employs public cloud services as its primary command and control (C2) servers. Kaspersky has assessed that CloudSorcerer\'s activities resemble those of the [CloudWizard APT](https://securelist.com/cloudwizard-apt/109722/). However, notable differences in the malware\'s code and functionality suggest that CloudSorcerer is likely a new actor. ## Detections/Hunting Queries ### Microsoft Defender Antivirus Microsoft Defender Antivirus detects threat components as the following malware: - [Trojan:Win32/Casdet](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Casdet!rfn) ## Recommendations Microsoft recommends the following mitigations to reduce the impact of this threat. - Turn on [cloud-delivered protection](https://learn.microsoft.com/en-us/defender-endpoint/linux-preferences) in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats. - Run [EDR in block mode](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/edr-in-block-mode?view=o365-worldwide?ocid=magicti_ta_learndoc) so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach. - Allow [investigation and remediation](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/automated-investigations?view=o365-worldwide?ocid=magicti_ta_learndoc) in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume. - [Enable](https://learn.microsoft.com/en-us/defender-endpoint/enable-controlled-folders) controlled folder access. - Ensure that [tamper protection](https://learn.microsoft.com/en-us/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection#how-do-i-configure-or-manage-tamper-protection) is enabled in Microsoft Defender for Endpoint. - Enable [network protection](https://learn.microsoft.com/en-us/defender-endpoint/enable-network-protection) in Microsoft Defender for Endpoint. - Follow the credential hardening recommendations in the [on-premises credential theft overview](https://security.microsoft.com/threatanalytics3/938 | Ransomware Malware Tool Threat Cloud | APT 27 APT 31 | ★★★ |
1
We have: 1 articles.
We have: 1 articles.
To see everything:
Our RSS (filtrered)
