Federal CIO returns to post

With its comprehensive passive/listener-based utilities for initial access and lateral movement, UNC1860 may have supported Iranian hacking attacks with the BABYWIPER malware against Israel last October and intrusions with the ROADSWEEP malware against Albania in 2022.

Xchange.cash was the most significant of the 47 sequestered exchanges, having more than 410,000 users and 1.28 million transactions, followed by 60cek.org, Bankcomat.com, Banksman.com, and Prostocash.com, all of which recorded more than 200,000 users and over 400,000 transactions.

The tactics used by Vanilla Tempest such as lateral movement via RDP are not novel – but attacks on healthcare by yet another ransomware strain complicates the picture.