BleepingComputer reports that Chinese state-sponsored threat operation APT41, also known as HOODOO, Winnti, and Barium, has targeted an Italian job-search website and a Taiwanese media firm in data exfiltration attacks involving the exploitation of the Google Command and Control red-teaming program.
Attacks using GC2 against the Italian job search entity were launched by APT41 last July, with the agent leveraged to facilitate further payload delivery and data exfiltration to Google Drive, according to the Google Threat Horizons report.
Meanwhile, the Taiwanese media organization was subjected to phishing emails with links redirecting to the GC2 payload in October but such a campaign has been thwarted by Google's Threat Analysis Group.
The findings represent the continuing transition of threat actors toward legitimate red-teaming tools and remote monitoring and management software in their attacks. With malicious Cobalt Strike usage more easily detected, attackers have since moved to use the Sliver and Brute Ratel red teaming tools, as well as the Action1 RMM tool.
Golden Chickens malware developer unmasked SecurityWeek reports that Golden Chickens malware, which has been used by the Russian Cobalt Group and FIN6 cybercrime operations, had its second developer identified by eSentire to be a Romanian named Jack, also known as Lucky and badbullzvenom. Password stealers were Jack's main specialty when he began engaging in cybercrime as a teen, releasing the Voyer malware tool for exfiltrating Yahoo instant messages between 2007 and 2008, followed by the FlyCatcher tool for keystroke logging between 2008 and 2009, and the Con password stealer for browser, instant messenger, VPN, and FTP app credential theft in 2010, according to the eSentire report. Jack was noted by researchers to have met with Golden Chickens co-developer 'Chuck from Montreal' in the dark web from late 2012 to October 2013, before proceeding to release Multiplier and VenomKit in 2015 and 2017, respectively, which were later consolidated into Golden Chickens. "Security experts assert that in 2017 the Cobalt Group used badbullzvenoms (aka: Lucky) VenomKit to deploy Cobalt Strike in attacks on banks and then they used it again in 2018," said eSentire, which noted that the malware suite was leveraged by FIN6 in 2019, the same year when the suite included the PureLocker ransomware plugin.
Different information-stealing malware strains have been distributed in separate campaigns leveraging websites masquerading as the TikTok video editor CapCut, according to BleepingComputer.
Open source password manager KeePass is being impacted by a security flaw, tracked as CVE-2023-32784, which could be exploited to facilitate master password retrieval from program memory, SecurityWeek reports. "The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system.
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news