Threat Intel Roundup

Content

01. Summary

02. Threat Spotlight

• Pelosi visit encourages PRC-Taiwan cyber attacks

• British “111” NHS hit by cyber attack

• Gamaredon Group delivers infostealer to Ukrainian targets

• Lazarus Group lures job seekers with fake employee prospects

03. Quick News Bites

• LockBit under DDoS attack: Entrust strikes back?

• CISA warns of high-severity flaw, requires government patching

• GitLab discovers critical RCE vulnerability

04. Conclusion

Pelosi visit encourages PRC-Taiwan cyber attacks

In early August, the US House of Representatives Speaker Nancy Pelosi visited Taiwan to reiterate US support to Taipei. This diplomatic mission caused further strain on the complicated relationship between the PRC and Taiwan. After threatening “severe consequences” if Taiwan allowed Pelosi to visit, Beijing carried out several military drills off the coasts of Taiwan to display its strength and disapproval of Pelosi’s mission. As often happens during tense geopolitical situations, the parties involved inconspicuously exchanged low-intensity cyber activity. Since Pelosi landed in Taiwan on 02 Aug 2022, the following malicious cyber activity was observed:

• Between 02 and 04 Aug 2022, the websites of Taiwan’s presidential office and Taiwan’s defense and foreign ministries were targeted by a distributed denial of service (DDoS) attack. No one has claimed responsibility for the attack, but the source IP addresses of the attack originated from outside of Taiwan.
• On 03 Aug 2022, members of the hacktivist group “Anonymous” reportedly defaced the webpage of the Heilongjiang Provincial Federation of Social Sciences (“hljskl[.]gov[.]cn”), a Chinese government institution. According to an archived version of the webpage, the defaced version included statements of support for Taiwan, as well as images of Nancy Pelosi and Taiwan President Tsai Ing-wen.
• On 04 Aug 2022, advanced persistent threat (APT) group “APT27” (aka Emissary Panda, Bronze Union, Iron Tiger) allegedly shut down 60,000 Taiwanese Internet of Things (IoT) devices. The group, which likely operates on behalf of the PRC state, has since reportedly also claimed responsibility for DDoS attacks against Taiwanese government ministries.
• On 04 Aug 2022, researchers observed a new disinformation campaign dubbed HaiEnergy. The campaign reportedly distributed fake news articles on subjects supporting the interests of the PRC. The major themes included Pelosi’s visit, Hong Kong’s electoral reform, and the treatment of the Uyghur population in the PRC.

British “111” NHS hit by cyber attack

On 04 Aug 2022, a cyber attack targeted Advanced, a managed service provider (MSP) that provides IT and software services to clients including the UK’s National Health Service (NHS). The attack impacted the NHS 111 emergency service, causing severe delays to ambulances and general practitioners’ appointments. This instance highlights how MSPs can be valuable targets for threat actors, propagating their attacks’ impacts to multiple victims at the same time.

Gamaredon Group delivers infostealer to Ukrainian targets

On 15 Aug 2022, security researchers reported that “Gamaredon Group” has been conducting a cyber-espionage campaign targeting Ukraine. Activity was first observed on 15 Jul 2022, and most recently on 08 Aug 2022. The group reportedly delivered variants of a PowerShell information stealer (infostealer) to Ukrainian targets, as well as custom backdoors, including “Pterodo” and “Giddome”. Researchers believe that the malware was delivered via spearphishing emails, likely with lures pertaining to the Russia-Ukraine war.

Lazarus Group lures job seekers with fake employee prospects

On 17 Aug 2022, researchers reported that the North Korea-linked APT “Lazarus Group” had been using a signed malicious executable designed to target macOS systems. Lazarus Group members were impersonating employees of the cryptocurrency-exchange company Coinbase, targeting job seekers in the financial technology sector. The campaign targeted new and old macOS versions, and used malware disguised as a PDF file containing a fake job description. The macOS malware was code-signed on 21 Jul 2022 with a certificate that was issued five months prior to a developer using the name Shankey Nohria. As of 12 Aug 2022, the certificate had not been revoked by Apple, but had not been checked by Apple’s process to discover malicious software components.