Threat Intelligence Bulletin – Weaponized PLCs, Response-based Attacks, and APT41
Researchers describe attack technique that weaponizes programmable logic controllers to gain entry to workstations and subsequently invade networks
Open redirect flaws being used to bypass spam filters and harvest credentials
Chrome unvalidated input zero-day patched, being actively exploited
41% of all email-based scams are response-based attacks in Q2 of this year
Several threat actors using DarkTortilla crypter to distribute info-stealers and RATs
Exploit for Realtek networking devices with RLT819x chip released online
Bumblebee malware loader being increasingly used by threat actors
Chinese threat actor APT41 (Wicked Spider) targeted at least 80 orgs last year, primarily hospitality and software development in the US and universities in UK and Ireland. Sources also outline their TTPs including how they hid their C2 beacons
- https://thehackernews.com/2022/08/china-backed-apt41-hackers-targeted-13.html
- https://www.bleepingcomputer.com/news/security/winnti-hackers-split-cobalt-strike-into-154-pieces-to-evade-detection/
Lazarus group targeting Apple M1 chips using executables distributed through fake cryptocurrency job postings