Lifeboat Foundation

The P2PInfect botnet worm is going through a period of highly elevated activity volumes starting in late August and then picking up again in September 2023.

P2PInfect was first documented by Unit 42 in July 2023 as a peer-to-peer malware that breaches Redis instances using a remote code execution flaw on internet-exposed Windows and Linux systems.

Cado Security researchers who have been following the botnet since late July 2023, report today seeing global activity, with most breaches impacting systems in China, the United States, Germany, Singapore, Hong Kong, the UK, and Japan.

A previously unknown threat actor dubbed ‘Sandman’ targets telecommunication service providers in the Middle East, Western Europe, and South Asia, using a modular info-stealing malware named ‘LuaDream.’

This malicious activity was discovered by SentinelLabs in collaboration with QGroup GmbH in August 2023, who named the threat actor and malware after the backdoor’s internal name of ‘DreamLand client.’

The operational style of Sandman is to keep a low profile to evade detection while performing lateral movement and maintaining long-term access to breached systems to maximize its cyberespionage operations.

The developers of Free Download Manager (FDM) have published a script to check if a Linux device was infected through a recently reported supply chain attack.

Free Download Manager is a popular cross-platform download manager that offers torrenting, proxying, and online video downloads through a user-friendly interface.

Last week, Kaspersky revealed that the project’s website was compromised at some point in 2020, redirecting a portion of Linux users who attempted to download the software to a malicious site.

The International Criminal Court (ICC) disclosed a cyberattack on Tuesday after discovering last week that its systems had been breached.

“At the end of last week, the International Criminal Court’s services detected anomalous activity affecting its information systems,” the ICC said.

“Immediate measures were adopted to respond to this cybersecurity incident and to mitigate its impact.”

This post is also available in: עברית (Hebrew)

A badly defended security camera is an easy target for hackers, as there are tools for easily hacking internet protocol (IP) cameras, and research revealed the prevalent problem of unprotected security cameras.

According to Cybernews researchers, there are currently at least 8,373 real-time streaming protocol (RTSP) cameras exposed worldwide. Exposed cameras mean that anyone could find even the latest saved screenshots of what the cameras see, with some cameras being found on Google. Furthermore, many cameras are left with default access passwords like “admin”.

Multiple prominent government ministries in Colombia are responding to a ransomware attack that is forcing officials to make significant operational changes.

This week, the Ministry of Health and Social Protection, the country’s Judiciary Branch and the Superintendency of Industry and Commerce announced that a cyberattack on technology provider IFX Networks Colombia had caused a range of problems limiting the ability of both departments to function.

On Wednesday, the Ministry of Health and Social Protection said it began facing issues on Tuesday after IFX Networks told them of problems affecting their data center.

When the botnet floods the target with excessive requests, service failures occur which jeopardize the availability of the targeted system and even put the integrity of the whole infrastructure at risk. When aimed against essential infrastructures such as healthcare or transportation, the hazards go beyond financial and reputational harm to endangering people’s lives.

Incorporating IoT Devices into Botnets

IoT devices that are unpatched, unattended, or misconfigured, or are already under botnet DDoS attack, are at risk of being incorporated into a botnet. To expand the botnet, an attacker hacks new IoT devices. This process involves two entities: the botnet itself and the loader server, a special server that infects other devices.

The threat group behind the fast-growing Rhysida ransomware-as-a-service operation has claimed credit for an Aug. 19 attack that crippled systems at Singing River Health System, one of Mississippi’s largest healthcare entities.

The attack follows one against California’s Prospect Medical Holdings in August that affected 16 hospitals and more than 160 clinics around the country. The wide scope of that incident prompted an alert from the Health Sector Cybersecurity Coordination Center to other organizations in the industry.

The attack on Singing River impacted three hospitals and some 10 clinics belonging to the system and is likely to reinforce Rhysida’s credentials as a growing threat to healthcare organizations in the US. It’s also a reminder of the surging interest in the sector from ransomware actors who, early in the COVID-19 pandemic, had piously vowed to stay away from attacking hospitals and other healthcare entities.

In a recent attack against a construction company, hackers who failed to execute LockBit in a target network were observed deploying a second, never-before-seen ransomware, which managed to break through.

The new tool is rather standard fare, blocking various cybersecurity and backup-related software before locking up files on its host computer. But it distinguishes itself with an adorable little theme: 3 a.m., a time when perhaps only insomniacs, hardcore night owls, and black hat hackers are still up and working away.

In a report this week, researchers from Symantec described the first observed use of 3AM — a double-whammy attack in which the LockBit ransomware was blocked but then 3AM squeaked through in one compromised machine.