News of the Cyber World

[kyonides]

White House Pushes TikTok’s Chinese Owners to Sell Platform

ByteDance, the Chinese parent company of TikTok, has recently come under pressure from the Biden administration to sell its megapopular video platform or face a ban in the U.S., according to the Wall Street Journal.

The Wall Street Journal reports that TikTok’s Chineseparent company, ByteDance, has come under pressure from the U.S. government to sell its shares in the popular video-sharing app or face a ban in the country. This development is a significant policy shift by the Biden administration and has sparked a new round of debate. Many have accused the Biden administration of not taking the alleged security threat posed by the China-based company seriously enough, especially after the Chinese company hired a Biden-connected consulting firm.

The sale demand was made by the Committee on Foreign Investment in the United States (CFIUS), a multi-agency federal task force that monitors national security risks associated with international investments. According to TikTok, which was founded in Beijing in 2012, 60 percent of ByteDance’s shares are owned by foreign investors, 20 percent by its staff, and 20 percent by the company’s founders. The founders’ shares do, however, have excessive voting rights, which is standard in the tech industry.

TikTok has stated in response to the CFIUS demand that a forced sale would not eliminate the alleged security risk. Instead, the company has promised to invest $1.5 billion in a program aimed at protecting American user data and content from being accessed or influenced by the Chinese government. In a statement, TikTok spokeswoman Brooke Oberwetter said: “If protecting national security is the objective, divestment doesn’t solve the problem: a change in ownership would not impose any new restrictions on data flows or access.”

Lookalike Telegram and WhatsApp Websites
Distributing Cryptocurrency Stealing Malware

Copycat websites for instant messaging apps like Telegram and WhatApp are being used to distribute trojanized versions and infect Android and Windows users with cryptocurrency clipper malware.

"All of them are after victims' cryptocurrency funds, with several targeting cryptocurrency wallets," ESET researchers Lukáš Štefanko and Peter Strýček said in a new analysis.
...
"Moreover, some of these apps use optical character recognition (OCR) to recognize text from screenshots stored on the compromised devices, which is another first for Android malware."

The attack chain begins with unsuspecting users clicking on fraudulent ads on Google search results that lead to hundreds of sketchy YouTube channels, which then direct them to lookalike Telegram and WhatsApp websites.
...
It's capable of intercepting a victim's chats and replacing any sent and received cryptocurrency wallet addresses with addresses controlled by the threat actors.

Another cluster of clipper malware makes use of OCR to find and steal seed phrases by leveraging a legitimate machine learning plugin called ML Kit on Android, thereby making it possible to empty the wallets.

A third cluster is designed to keep tabs on Telegram conversations for certain Chinese keywords, both hard-coded and received from a server, related to cryptocurrencies, and if so, exfiltrate the complete message, along with the username, group or channel name, to a remote server.

Multiple Hacker Groups Exploit 3-Year-Old Vulnerability
to Breach U.S. Federal Agency

Multiple threat actors, including a nation-state group, exploited a critical three-year-old security flaw in Progress Telerik to break into an unnamed federal entity in the U.S.

The disclosure comes from a joint advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC).

"Exploitation of this vulnerability allowed malicious actors to successfully execute remote code on a federal civilian executive branch (FCEB) agency's Microsoft Internet Information Services (IIS) web server," the agencies said.

The indicators of compromise (IoCs) associated with the digital break-in were identified from November 2022 through early January 2023.
...
The DLL artifacts are designed to gather system information, load additional libraries, enumerate files and processes, and exfiltrate the data back to a remote server.
...
These DLL files dropped and executed reverse (remote) shell utilities for unencrypted communications with a command-and-control domain to drop additional payloads, including an ASPX web shell for persistent backdoor access.

Israel blames prolific Iranian-linked hacking group for February university hack

A prolific hacking group affiliated with the Iranian government is responsible for the Feb. 11 cyberattack on Technion University in Israel, the Israeli government said Tuesday.

Israel’s National Cyber Directorate attributed the attack to a well-known and long-running Iranian-linked hacking group known as “MuddyWater,” saying that the group used malware designed to encrypt operating systems, according to a statement from the agency provided to CyberScoop Wednesday.

The statement warned that the “month of Ramadan, which this year begins in the end of March, is prone to cyberattacks against diverse targets in Israel, aiming to disrupt their business activities and sully their reputation.”
...
The U.S. government publicly linked to the Iranian Ministry of Intelligence and Security for the first time in January 2022, when U.S. Cyber Command shared a series of malware samples associated with the group on VirusTotal. A joint advisory from the U.S. and British governments in February 2022 called MuddyWater “a group of Iranian government-sponsored” hackers conducting cyber espionage and other malicious cyber activities targeting telecommunications, defense, local government and oil and natural gas targets in Asia, Africa, Europe and North America.

Hackers Exploiting Silicon Valley Bank (SVB) Collapse to Launch Cyber-Attacks

These impacted businesses, therefore, look for alternate finance sources to maintain their functioning. They have become a top target for Threat Actors (TAs), who are exploiting the current circumstance by carrying out different malicious acts, due to their need for financial stability.

These operations seek to deceive targets by stealing money, account information, or malware.

In the wake of the SVB collapse, multiple suspicious websites have surfaced (listed below), according to Cyble Research & Intelligence Labs (CRIL).

• svbcollapse
  
• svbclaim
  
• svbdebt
  
• svbclaims
  
• svblogin
  
• login-svb
  
• svbbailout
  
• svb-usdc
  
• svbi
  
• svbank
  
• banksvb
  

Just add a .com or .net or even a .io domain to any of the fake urls they've provided there, open it by right clicking on it and you're fried.

He added that scammers would try to contact former SVB customers and offer them a support package, legal services, loans, or other fake services related to the bank’s failure.

Notably, an attack by BEC threat actors, who pose as SVB customers and request money be transmitted to a new bank account following the bank’s collapse, has already been observed in the wild.