A sophisticated cyber espionage campaign attributed to APT MuddyWater has emerged targeting Chief Financial Officers and finance executives across Europe, North America, South America, Africa, and Asia.

The threat actors are deploying a multi-stage phishing operation that masquerades as legitimate recruitment communications from Rothschild & Co, leveraging Firebase-hosted phishing pages with custom CAPTCHA challenges to deceive high-value targets.

The campaign demonstrates significant evolution in the group’s tactics, incorporating legitimate remote access tools including NetBird and OpenSSH to establish persistent backdoors within corporate networks.

The attack sequence begins with carefully crafted spear-phishing emails that direct victims to Firebase-hosted domains such as googl-6c11f.firebaseapp.com, where targets encounter seemingly legitimate “human verification” challenges.

Upon completing these fabricated CAPTCHA tests, victims are redirected to secondary phishing sites that deliver malicious ZIP archives disguised as PDF documents.

These archives contain VBScript files that initiate a complex multi-stage infection process designed to deploy remote access capabilities while maintaining stealth.

Hunt.io analysts identified critical infrastructure shifts within this campaign, noting the transition from previously documented command-and-control servers at 192.3.95.152 to new infrastructure at 198.46.178.135.

The researchers discovered multiple Firebase projects utilizing identical phishing kits, including cloud-ed980.firebaseapp.com and cloud-233f9.web.app, all employing AES-encrypted redirect mechanisms with hard-coded passphrases to evade detection systems.

The malware’s persistence mechanisms represent a particularly concerning aspect of this campaign.

The initial VBS downloader (F-144822.vbs) retrieves a secondary payload from the attacker-controlled infrastructure, specifically targeting the path /34564/cis.ico, which is renamed to cis.vbs upon execution.

This second-stage script performs several critical functions, including the silent installation of NetBird and OpenSSH MSI packages using the following command structure:-

msiexec /i netbird.msi /quiet
msiexec /i OpenSSH.msi /quiet

Advanced Persistence and Remote Access Implementation

The campaign’s most sophisticated element lies in its comprehensive persistence strategy, which combines multiple legitimate tools to establish redundant access channels.

The malware creates a hidden administrative account named “user” with the password “Bs@202122”, effectively providing attackers with privileged system access that persists across system reboots.

This account is strategically hidden from Windows login screens through registry modifications, ensuring it remains undetected during routine system administration activities.

NetBird deployment utilizes a preconfigured setup key (E48E4A70-4CF4-4A77-946B-C8E50A60855A) to establish secure tunnel connections, while simultaneously enabling Remote Desktop Protocol services and configuring firewall exceptions.

The malware ensures service reliability through scheduled task creation, specifically implementing “ForceNetbirdRestart” tasks that automatically restart NetBird services after system startup delays.

Additionally, the campaign removes NetBird desktop shortcuts from all user profiles, effectively concealing the presence of newly installed remote access software from casual observation by system administrators or users.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post APT MuddyWater Attacking CFOs Leveraging OpenSSH, Enables RDP, and Scheduled Task appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a sophisticated new threat campaign that leverages a seemingly legitimate PDF editor application to transform infected devices into residential proxies.

The malicious software, distributed under the guise of productivity tools, represents an evolving approach by threat actors who are increasingly exploiting trusted software categories to establish persistent network access and monetize compromised systems.

The attack begins with files bearing the code-signing signature “GLINT SOFTWARE SDN. BHD.” which initially appears to lend credibility to the malicious payload.

However, beneath this veneer of legitimacy lies a complex infection chain that starts with JavaScript components designed to drop and execute the primary trojan, dubbed “ManualFinder.”

This multi-stage approach demonstrates the attackers’ understanding of modern security detection mechanisms and their efforts to evade traditional signature-based detection systems.

ExpelSecurity analysts identified this emerging threat through their monitoring of suspicious network activities and file behavior patterns.

The researchers observed that the malware’s initial deployment strategy relies heavily on the OneStart Browser application, which has been flagged as consistently problematic software.

This browser creates scheduled tasks that execute JavaScript files from the user’s temporary directory, establishing a foothold for the subsequent malware deployment.

The infection mechanism reveals a carefully orchestrated process where the JavaScript component reaches out to command and control domains, specifically mka3e8[.]com and similar infrastructure.

These domains serve as distribution points for the ManualFinder application, which maintains the same fraudulent code-signing certificate to maintain the appearance of legitimacy throughout the infection chain.

Deceptive Functionality and Proxy Operations

What makes this threat particularly insidious is its dual-purpose design that combines genuine functionality with malicious behavior.

When executed in a controlled sandbox environment, ManualFinder actually performs its advertised function of helping users locate product manuals and documentation.

This legitimate functionality serves as an effective smokescreen, potentially allowing the malware to bypass behavioral analysis systems that might otherwise flag purely malicious code.

However, the application’s true purpose becomes evident when analyzing its network behavior and system modifications.

The trojan transforms infected devices into residential proxy nodes, effectively creating a distributed network of compromised systems that can be monetized by the threat actors.

This proxy functionality allows attackers to route traffic through victim machines, potentially facilitating various illegal activities while obscuring the true source of malicious network traffic.

The malware’s persistence mechanism through OneStart Browser’s scheduled task creation ensures continued operation even after system reboots.

This approach highlights the attackers’ focus on maintaining long-term access to compromised systems rather than pursuing immediate, obvious malicious activities that might trigger user suspicion or security alerts.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Threat Actors Weaponize PDF Editor With New Torjan to Turn Device Into Proxy appeared first on Cyber Security News.

The Federal Bureau of Investigation has issued a critical security alert regarding sophisticated cyber operations conducted by Russian Federal Security Service (FSB) Center 16, targeting networking infrastructure across the United States and globally.

The threat actors have been exploiting vulnerable networking devices to gain unauthorized access to critical infrastructure systems, demonstrating a calculated approach to compromising essential services.

The campaign leverages an unpatched vulnerability, CVE-2018-0171, found in Cisco Smart Install (SMI) protocol implementations alongside Simple Network Management Protocol (SNMP) weaknesses.

These attack vectors allow the threat actors to remotely access end-of-life networking devices that lack current security patches, creating persistent entry points into targeted networks.

FBI analysts identified that the threat actors have successfully collected configuration files from thousands of networking devices associated with US entities across multiple critical infrastructure sectors.

The scope of this operation reveals a systematic approach to mapping network architectures and identifying high-value targets within industrial control systems.

The FSB Center 16 unit operates under several aliases known to cybersecurity professionals, including “Berserk Bear,” “Dragonfly,” and more recently identified as “Static Tundra” by Cisco Talos researchers.

This threat group has maintained operations for over a decade, consistently targeting devices that accept legacy unencrypted protocols.

Configuration File Manipulation and Persistence Mechanisms

The attack methodology centers on sophisticated configuration file manipulation techniques that enable long-term persistence within compromised networks.

Once initial access is achieved through the CVE-2018-0171 vulnerability, the threat actors systematically modify device configuration files to establish backdoor access mechanisms.

These modifications are carefully crafted to blend with legitimate network configurations, making detection challenging for standard security monitoring tools.

The actors demonstrate particular interest in protocols and applications commonly associated with industrial control systems, suggesting strategic targeting of operational technology environments.

By maintaining access through modified configuration files, the threat group can conduct extended reconnaissance operations while remaining undetected within victim networks.

This persistent access method allows the attackers to monitor network traffic patterns, identify critical system dependencies, and potentially position themselves for future disruptive operations against essential infrastructure services.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post FBI Warns of Russian Government Hackers Attacking Networking Devices of Critical Infrastructure appeared first on Cyber Security News.