Russian Hackers Target Ukraine, Chinese USB Malware, Banking Trojan on the Rise! | June 27,2023
Channel: Hacking Space Frontier
Date: 2023-06-27

Fancy Bear Targets Ukrainian Entities:
The BlueDelta campaign, attributed to the APT28 threat actor (also known as "Fancy Bear") associated with the Russian GRU, is targeting Ukrainian government and military entities. The campaign utilizes spear-phishing techniques and exploits vulnerabilities in Roundcube, an open-source webmail software. By sending emails with attachments containing JavaScript code, the threat actor gathers sensitive information such as session cookies, user information, and address books.

Camaro Dragon Spreads Malware via USB Drives:
The Chinese-based espionage group Camaro Dragon has been identified as the source of a USB-propagated malware campaign. The malware spreads through USB drives and was discovered during an investigation into an incident at a European hospital. The malware is not specifically targeted but spreads as collateral damage. The initial infection occurred when an individual connected an infected USB drive to a colleague's computer, highlighting the self-propagating nature of the malware.

Anatsa Trojan's New Capabilities:
The Android banking Trojan Anatsa has expanded its target banks to include institutions in the US, UK, and Germany. The Trojan is distributed through malicious apps in the Google Play Store and has been downloaded over 30,000 times in the current campaign. Once a device is infected, Anatsa collects sensitive information through overlay attacks and keylogging. This allows criminals to perform fraud, including Device-Takeover Fraud (DTO), which poses challenges for banking anti-fraud systems.

Transparent Tribe Resurfaces against Indian Military and Academic Targets:
A subdivision of the threat actor Transparent Tribe, known as SideCopy, is targeting the Indian military and the education sector. The campaign utilizes infection chains with themes related to the Defense Research and Development Organization (DRDO) and the Indian Military. The activity was exposed after a senior DRDO scientist was arrested for leaking sensitive information to Pakistani agents who had honey trapped him.