Threat Intelligence Report – July: 2nd Week

This Threat Intelligence Report summarizes significant cyber threats and vulnerabilities observed during the second week of July 2024.

Ransomware

1. ShadowRoot Ransomware Targets Turkish Businesses

Victim: Turkish Businesses

The ransomware arrives through suspicious emails with PDF attachments, likely disguised as invoices, originating from the “.ru” domain. The embedded links within the PDF facilitate the download of a subsequent stage exe payload upon user interaction. It encrypts files with the “.shadowroot” extension. 

Reference: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses

2. New Eldorado Ransomware Attacking Windows And Linux Systems

Victim: Windows And Linux Systems

Eldorado, an emerging ransomware-as-a-service (RaaS) operation, offers locker variations for encrypting files on Windows and Linux systems. The ransomware spreads through phishing emails and can target network shares using the Server Message Block (SMB) protocol.

It uses Golang for cross-platform functionality and encrypts files using a combination of Chacha20 and RSA-OAEP encryption algorithms

Eldorado’s encryptor comes in four formats: esxi, esxi_64, win, and win_64, and its data leak site already lists 16 victims as of June 2024. Thirteen targets are in the United States, two in Italy, and one in Croatia.

Reference:

1. https://thehackernews.com/2024/07/new-ransomware-as-service-eldorado.html
2. https://gbhackers.com/new-eldorado-ransomware-attacks-windows-linux/

3. Nigerian cloud provider affected in Phobos ransomware attack

Victim: Nigerian cloud

The Nigerian Computer Emergency Response Team (ngCERT) reported a rise in Phobos ransomware attacks targeting the country’s cloud service providers in early July 2024

ngCERT did confirm that at least one Nigerian cloud provider was compromised by Phobos ransomware, but the specific company name remains undisclosed

Phobos attackers obtain access to vulnerable networks by sending phishing emails or using IP scanning tools to find vulnerable Remote Desktop Protocol (RDP) ports. When successful, such attacks cause system compromise, ransom payments, data loss, financial losses, and fraudulent behavior, according to ngCERT.

Reference: https://techcabal.com/2024/07/10/cloud-providers-ransomware-attack/

4. ARRL finally confirms ransomware gang stole data in a cyberattack

Victim: American Radio Relay League (ARRL)
Date: July 11, 2024

The American Radio Relay League (ARRL) finally confirmed that some of its employees’ data was stolen in a ransomware attack in May 2024.

In early June, it also revealed that its systems were hacked by a “malicious international cyber group” in a “sophisticated network attack.”

Although ARRL discovered no evidence that the stolen personal information was misused, it decided to provide people affected by the data breach with 24 months of free identity monitoring through Kroll out of “an abundance of caution.”

Reference: https://www.bleepingcomputer.com/news/security/arrl-finally-confirms-ransomware-gang-stole-data-in-cyberattack/

5. Rite Aid confirms data breach after June ransomware attack

Victim: Rite Aid

Pharmacy giant Rite Aid confirmed a data breach after suffering a cyberattack in June, which was claimed by the RansomHub ransomware operation.

While Rite Aid didn’t share what customer data was accessed in the breach or how many individuals were affected, it said that the data breach doesn’t impact health or financial information.

Reference: https://www.bleepingcomputer.com/news/security/rite-aid-confirms-data-breach-after-june-ransomware-attack/

6. American Golf Corporation Hit by MEDUSA Ransomware

Victim: American Golf Corporation (AGC)

Attacker: The MEDUSA ransomware group is believed to be behind the attack on AGC

The hackers allegedly exfiltrated 154.9 GB of data, including email correspondence, members’ data, orders, full access account credentials (User ID, Passwords, Secret Keys), reports, licenses, passports, and financial data.

Reference: https://thecyberexpress.com/american-golf-corporation-medusa-ransomware/

Vulnerabilities