Cybersecurity Update March 21st 2023: China’s Zero-Days, Banking Trojans, DoS attacks and more!

As cyberattacks continue to become more sophisticated and frequent, several significant developments have emerged in the world of cybersecurity. This article covers some of the most important news in the industry, including the increasing use of zero-day vulnerabilities by state-backed actors, the emergence of a new banking Trojan in Latin America, and a report by ENISA warning of ransomware attacks targeting transport sector OT.

China Leads in Zero-Day Vulnerabilities

According to a new report by Mandiant, state-backed actors are increasingly using zero-day vulnerabilities to exploit networks. In 2022, China-affiliated actors exploited seven zero-days, more than any other country. Russian and North Korea-affiliated groups each used two zero-days. State-backed actors seemed focused on routers, firewalls, and other edge network devices, which are crucial for obtaining initial access.

ShellBot Malware Targets Poorly Managed Linux Servers

A new campaign that deploys different variants of malware called ShellBot is targeting poorly managed Linux SSH servers. The malware is developed in Perl and characteristically uses IRC protocol to communicate with the C&C server. ShellBot is installed on servers that have weak credentials and uses scanner malware to identify systems that have SSH port 22 open. ShellBot uses the Internet Relay Chat (IRC) protocol to communicate with a remote server, allowing it to receive commands that enable it to carry out DDoS attacks and exfiltrate harvested information.

Banking Trojan Hits Latin America

A banking trojan called Mispandu has been used in campaigns targeting Bolivia, Chile, Mexico, Peru, and Portugal since August 2022. The trojan isn’t new, having been first spotted by ESET in 2019. The campaigns involve compromising legitimate WordPress sites to serve as C2 servers. Researchers estimate Mispandu harvested over 90,000 bank credentials in these attacks.

ENISA Report Warns of Ransomware Attacks Targeting Transport Sector OT

The European Union Agency for Cybersecurity (ENISA) has issued a report analyzing transport sector incidents from January 2021 until October 2022. The report found that recorded attacks against the aviation, maritime, rail, and road sectors are going up, with ransomware attacks increasing in frequency. ENISA warns that ransomware attacks will become a tool wielded for political as well as financial motivations. The overlapping of IT and OT means that “ransomware groups will likely target and disrupt OT operations in the foreseeable future.” No attack appeared to have affected the safety of transportation during the two years covered by the report.

HinataBot Focuses on DDoS Attacks

Researchers at Akamai have released details on HinataBot, a botnet that has been active since December 2022. The botnet targets weak credentials and old remote code execution vulnerabilities, using infected devices to launch DDoS attacks. Akamai researchers said they didn’t observe any specific targets for exploitation yet.

Vulnerability Lets You Uncrop Screenshots

A vulnerability was found in the Markup tool on Google Pixel devices, which could allow for uncropping images. The bug report notes many social media services re-process uploaded images, so that extra data isn’t accessible. Google fixed the issue in its March security patch.

Punjab Internet Outage Goes on for Three Days

The Indian government blocked internet access in the state of Punjab on March 18th, initially saying it would last for 24-hours. The government subsequently expanded the ban the following two days, now persisting into March 21st. Punjab police say 112 people have been arrested following protests around the separatist movement. This outage impacts roughly 27 million people in the region.

BBC Issues TikTok Security Advisory

The BBC issued an advisory to staff, strongly recommending removing TikTok from corporate phones. It cited privacy and security fears. The BBC will continue using it for marketing purposes.

Banking Trojan Hits Latin America

A banking trojan called Mispandu has been used in campaigns targeting Bolivia, Chile, Mexico, Peru, and Portugal since August 2022. The trojan itself isn’t new, first spotted by ESET in 2019. The campaigns involve compromising legitimate WordPress sites to serve as C2 servers. The researchers estimate Mispandu harvested over 90,000 bank credentials in these attacks.

UK Ransomware Incidents Up 17%

The UK saw a 17% increase in ransomware incidents in 2022, with the newly resurgent LockBit ransomware group accounting for over 30% of all UK ransomware incidents in the year. Jumpsec found the Karakurt group focused more on high-value organizations in the year, while Vice Society focused on its education sector, the most targeted UK sector in the year.