Brief #39: iOS Trojan Steals FaceID, Akira Attacks & More

This week, the cybersecurity landscape continues to evolve at an unprecedented pace, with new threats emerging that challenge even the most robust defenses. From sophisticated malware to intricate vulnerabilities and covert state-sponsored activities, it's clear that staying ahead requires constant vigilance.

Before we delve into the latest developments that have caught the industry's attention, let's quickly revisit a piece from last week. If you haven't already, I highly recommend checking out our discussion on how to ditch fear tactics and secure board buy-in on cybersecurity. It's for anyone looking to navigate the complex dynamics of organizational support in cybersecurity efforts.

Now, onto this week's Brief:

First iOS Trojan Targets Facial Recognition to Breach Bank Accounts

• Sophisticated iOS Trojan Unearthed: Group-IB researchers have identified a new, sophisticated iOS Trojan named GoldPickaxe.iOS, part of the GoldDigger family, targeting financial institutions in the Asia-Pacific region. This discovery marks a significant evolution in mobile banking malware, with the Trojan capable of harvesting facial recognition data, identity documents, and intercepting SMS. The Trojan can also steal Apple's FaceID mechanisms.
• Deepfake Technology Exploited for Financial Fraud: GoldPickaxe employs advanced AI-driven face-swapping services to create deepfakes, utilizing stolen biometric data alongside ID documents and intercepted SMS. This innovative technique enables unauthorized access to victims' banking accounts, showcasing a novel method of monetary theft previously unseen in the cybersecurity domain.
• Innovative Distribution via TestFlight and MDM: The Trojan's distribution exploits Apple's TestFlight and Mobile Device Management (MDM) profiles, demonstrating a sophisticated multi-stage social engineering scheme. Initially spread through TestFlight, the threat actor later shifted to persuading victims to install a malicious MDM profile, granting them complete control over the victim's device.
• Extensive Impact and Evolutionary Insights: GoldPickaxe.iOS is part of a larger cluster of banking Trojans actively targeting the APAC region, attributed to a threat actor codenamed GoldFactory. This group has shown significant organizational capabilities and technical sophistication, suggesting a well-resourced, Chinese-speaking cybercrime entity with close connections to other malware families like Gigabud.

Akira Ransomware Exploiting Cisco ASA/FTD Vulnerability

• Widespread Exploitation Alert: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about the Akira ransomware exploiting a zero-day vulnerability in Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) products, identified as CVE-2023-20269. This vulnerability allows for brute force attacks without authentication​​​​​​.
• Technical Breakdown: The vulnerability, rated with a medium severity CVSS score of 5.0, stems from improper separation of authentication, authorization, and accounting (AAA) functions, enabling attackers to conduct brute force attacks to identify valid username-password pairs or establish unauthorized clientless SSL VPN sessions​​​​​​.
• Ransomware Tactics: Attackers exploit this flaw to gain initial access to corporate networks, utilizing the compromised VPNs to deploy Akira ransomware. This campaign notably targets networks that lack multi-factor authentication (MFA), emphasizing the importance of MFA in mitigating such threats​​​​.
• Mitigation and Response: While Cisco works on security updates for ASA and FTD software to address this vulnerability, they have suggested workarounds and emphasized the deployment of MFA. The company also released indicators of compromise (IoCs) to aid organizations in identifying potential breaches​​​​.

Critical Exchange Server Vulnerability CVE-2024-21410 Exploited in the Wild

• Broad Impact: A critical vulnerability, CVE-2024-21410, affecting Microsoft Exchange Server, poses a severe risk with a CVSS score of 9.8. Exploited actively before the February 2024 Patch Tuesday updates, this flaw allows remote, unauthenticated attackers to escalate privileges through NTLM relay attacks.
• Technical Breakdown: The vulnerability exploits weaknesses in the NTLM protocol, enabling attackers to relay NTLM credential leaks from clients like Outlook against vulnerable Exchange Servers. This effectively impersonates the targeted user, granting attackers elevated privileges and paving the way for further malicious activities.
• Mitigation Measures: Microsoft has addressed this vulnerability in the Exchange Server 2019 Cumulative Update 14 (CU14), introducing NTLM credentials Relay Protections, also known as Extended Protection for Authentication (EPA). This update is crucial for preventing NTLM relay attacks by enhancing authentication security.
• Wider Context: The discovery and exploitation of CVE-2024-21410 underscore the persistent threat landscape targeting critical infrastructure components like Exchange Server. Organizations are urged to apply the latest patches and review their security posture to mitigate potential exploitation risks effectively.

New Rust-Based macOS Malware Links to Ransomware Groups, Exploiting Visual Studio Updates

• Overview of the Threat: Researchers have identified a new macOS backdoor named Trojan.MAC.RustDoor, potentially connected to the notorious ransomware groups BlackBasta and ALPHV/BlackCat. This malware, written in Rust, is designed to impersonate Visual Studio updates, demonstrating an evolution in cyberattack sophistication targeting macOS users​​​​.
• Technical Insights and Variants: The malware exhibits multiple variants with shared backdoor functionalities, supporting commands for file manipulation and system information gathering. The first variant, noted as a testing version, lacks complete persistence mechanisms, while the second variant features a complex JSON configuration and an Apple script for data exfiltration. The least complex, Variant Zero, maintains basic backdoor functions without the advanced scripts and configurations of the others​​​​.
• Persistence and Evasion Tactics: Trojan.MAC.RustDoor employs several persistence mechanisms uncommon in recent malware families, including modifications to cronjobs, LaunchAgents, the macOS Dock, and the .zshrc file. These techniques ensure the malware's continued execution and complicate detection efforts by security software, showcasing the malware authors' deep understanding of macOS internals​​.
• Implications and Response: The discovery underscores the growing complexity of malware targeting macOS, a platform once considered more secure than its counterparts. Security researchers and practitioners must remain vigilant, adopting advanced detection and response strategies to combat these evolving threats. The association of this malware with known ransomware groups also highlights the expanding arsenal of cybercriminals and the need for cross-platform security awareness​​​​.

Russia-aligned Hackers Escalate Espionage with Embassy Attacks and CISA Warns of New Vulnerability

• Cyber Espionage Targets European and Iranian Embassies: A new campaign by Russia-aligned hackers has targeted embassies across Europe and Iran, indicating a sophisticated effort aimed at espionage.
• CISA Adds Critical Vulnerability to Catalog: The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-43770, a persistent Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail, to its Known Exploited Vulnerabilities Catalog, emphasizing the risk it poses to the federal enterprise.
• Active Exploitation Poses Significant Risks: The identified vulnerabilities serve as key attack vectors for malicious actors, highlighting the ongoing and active threat landscape organizations must navigate.
• Urgent Call for Remediation: Both the specific espionage campaign and the newly identified vulnerability underscore the critical need for timely remediation practices within cybersecurity protocols to protect against potential breaches and espionage activities.