Cyber Intelligence Briefing: 14 July 2023

The S-RM Cyber Intelligence Briefing is a weekly round-up of the latest cyber security news, trends, and indicators, curated by our intelligence specialists.

top NEWS stories this week

1. No silver lining. Chinese hackers gain access to US government agencies cloud email. 
2. Fatal flaw. Criminals exploit error in Revolut payment system to steal USD 20 million. 
3. Bitter pill to swallow. HCA Healthcare and Barts NHS Trust face data extortion. 
4. Speared. State-linked threat actors utilise targeted phishing techniques. 
5. Blast from the past. Two major USB-based malware campaigns detected. 
6. Patch time. Apple, Microsoft, and Fortinet release patches addressing critical vulnerabilities. 

1. CHINESE HACKERS BREACH US GOVERNMENT EMAIL SYSTEMS 

A China-based espionage group breached the cloud-based Outlook email systems of 25 organisations, including multiple US and European government agencies. The group, dubbed Storm-0558, gained access by exploiting a now remediated flaw in Microsoft’s token validation mechanism.  

2. CRIMINALS STEAL USD 20 MILLION AFTER EXPLOITING REVOLUT FLAW  

A flaw in Revolut’s payment system allowed criminals to steal USD 20 million of corporate funds over several months in 2022. The flaw, which stemmed from differences between US and European payment systems, meant Revolut would issue refunds when certain transactions were declined. Criminals would make fraudulent transactions and cash out funds via ATMs. 

3. HCA HEALTHCARE AND BARTS NHS TRUST DATA BREACH

Data belonging to an estimated 11 million patients from the US-based company HCA Healthcare has been posted for sale on a hacking forum. The data came up for sale after HCA refused to pay a ransom.  

In a separate incident, ransomware group BlackCat/AlphV claim to have stolen seven TB of data from Barts NHS Trust, which operates hospitals in London. The group reportedly skipped the deployment of ransomware encryption as no service outages have been reported. 

4. PHISHING CAMPAIGNS AGAINST NATO-ALIGNED TARGETS  

The Iranian-linked threat actor APT TA453 is impersonating Western academics to spread a single-click malware via email. Separately, an anti-Ukrainian group has been sending emails with a link to a fake Ukrainian World Congress website, which if visited, is designed to install a remote access trojan.   

5. TWO NEW USB-BASED MALWARE CAMPAIGNS OBSERVED 

According to security researchers, USB drive malware attacks have tripled in the first half of 2023, with two major malware strains identified: 

• Sogu malware. Spread by the Chinese espionage threat group ‘TEMP.HEX and is targeting global industries primarily for data theft. 
• Snowydrive. If installed, this can allow threat actors to execute commands and take control of compromised systems. Organisations within the Asia oil and gas sector are being targeted.

6. CRITICAL PATCHES RELEASED FOR APPLE, MICROSOFT AND FORTINET PRODUCTS  

• Apple has released an emergency update to address a critical zero-day vulnerability being exploited by threat actors. The vulnerability affects a browser module and could allow threat actors to remotely execute code on iPhone, iPad, and MacOS. 
• Microsoft fixed 132 vulnerabilities in this month's Patch Tuesday. This included nine critical remote code execution vulnerabilities and six zero-day vulnerabilities.
• Fortinet has disclosed a critical vulnerability affecting FortiOS and FortiProxy that could allow a threat actor to remotely execute code. However, the company has stated that the issue has been addressed in the most recent release of their products. 

S-RM are proud to have been voted Cyber Incident Response Team of the Year at Zywave’s 2023 Cyber Risk Awards. Read more here.