Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole

Welcome to this week's edition of the Threat Source newsletter.

Law enforcement organizations across the globe notched a series of wins over the past few weeks against online forums for cybercriminals.

On March 23, the FBI announced it disrupted the online cybercriminal marketplace BreachForums, known for being a place where users could buy and sell stolen user information. They also arrested a 20-year-old suspected of being the site's founder and main administrator.

Then last week we had "Operation Cookie Monster" in which several international agencies worked together to take down Genesis Market, a similar dark web forum, arresting dozens of suspected users and administrators.

These arrests and network operations are important in that they disrupted sites that were known for highly sensitive information and served as a place for some of the most prolific cyber criminals to make money. The U.S. Department of Justice estimated that Genesis Market was responsible for the sale of data on more than 1.5 million compromised computers around the world containing over 80 million account access credentials. And the U.K.'s National Crime Agency (NCA) said credentials were available for as little as 70 cents to hundreds of dollars depending on the stolen data available.

But the user base for these sites was also huge (after all, someone had to be buying those credentials). At the time of its takedown, BreachForums had 340,000 members, according to the FBI. And reporting on Operation Cookie Monster stated that Genesis Market had 59,000 registered users.

So while it's great that these sites have been disrupted, I can't help but assume that two more sites are going to pop up to service these cyber criminals. It's impossible for any agency to arrest 340,000 people, so even if a handful of administrators are restricted from accessing the internet for a while, the other 339,000 people are going to be looking for a new home.

Some of the same agencies celebrated in March 2021 that they disrupted Emotet, one of the most infamous botnets ever. As anyone who follows security news will know, Emotet didn't actually go anywhere and was recently rebooted as recently as last month, according to our research.

RaidForums, a forefather of BreachForums, was also disrupted in April 2022, along with the arrest of several administrators and accomplices.

All of this is not to discount the great strides made in the past few weeks in disrupting these marketplaces and taking them offline. But a lot of these headlines are sounding familiar to me after a few years, so it's important to remember that we as a security community can't take our foot off the gas and assume that because there were a few big wins that dark web forums are just going to go away forever.

The one big thing

Microsoft's Patch Tuesday for April included another zero-day vulnerability in the Windows Common Log File System Driver. CVE-2023-28252, which could allow an attacker to obtain SYSTEM privileges, is actively being exploited in the wild, according to Microsoft. The U.S. Cybersecurity and Infrastructure Security Agency already added the vulnerability to its list of know exploited issues and urged federal agencies to patch it as soon as possible. Microsoft disclosed a similar zero-day issue in September that could also lead to the same privileges: CVE-2022-37969.

Why do I care?

Security researchers say that the vulnerability has already been exploited in Nokoyawa ransomware attacks, so it's important to patch this issue as soon as possible. The Nokoyawa ransomware is known for targeting 64-bit Windows systems in double extortion attacks in which the actors encrypt targets' files and then threaten to leak them unless the ransom is paid.

So now what?

Microsoft has a patch available, so all Windows users should update now if they haven't already. Talos also has new Snort detection coverage available for CVE-2023-28252 and other vulnerabilities disclosed as part of Patch Tuesday.

Top security headlines of the week

A trove of classified military documents and images leaked on several social media channels over the past week, including potentially sensitive information on Russia's invasion of Ukraine and China's military plans. The images first surfaced in a Discord channel, eventually making their way onto the Telegram messaging app, the popular forum 4Chan and then broader social media sites like Twitter. The U.S. Department of Justice and the Pentagon have since launched a formal investigation into the leaks. Ukrainian officials have blamed Russian actors for the leaks, trying to cast doubt on the authenticity of the images, while Russia accused Western governments of trying to spread disinformation. (Bellingcat, New York Times)

Apple released patches for two zero-day vulnerabilities targeting current and older versions of iOS, iPadOS, macOS and Safari that attackers were exploiting in the wild. The vulnerabilities, CVE-2023-28206 and CVE-2023-28205, could lead to arbitrary code execution. CVE-2023-28206 specifically could allow an adversary to execute code with kernel privileges. Apple initially patched the issue in current iPhones and other devices and followed up a few days later with fixes for older hardware like the iPhone 8. This was the third instance of Apple patching a zero-day vulnerability since the start of the year. (SC Media, Security Week)

The FBI warned users again this week against plugging their phones in public charging stations at common spaces like airports, hotels and shopping centers. The agency stated that threat actors have found ways to use the public USB ports to "introduce malware and monitoring software onto devices." Instead, the Federal Communications Commission suggests users carry their own USB cables and charging blocks to plug directly into outlets rather than relying on or trusting a cable. However, the tweet from the FBI's Denver office did not offer examples of any recent attacks that would have prompted a fresh warning. (Axios, NBC News)

Can't get enough Talos?

• How threat actors are using AI and other modern tools to enhance their phishing attempts
• How do you hunt cybersecurity threats in a war zone? Like this
• Cisco unveils latest security trends from Cisco Talos report at GISEC 2023
• Researcher Spotlight: Giannis Tziakouris first learned how to fix his family's PC, and now he's fixing networks all over the globe

Upcoming events where you can find Talos

RSA (April 24 - 27)

San Francisco, CA

Cisco Talos Incident Response: On Air (April 27)

Virtual

Cisco Live U.S. (June 4 - 8)

Las Vegas, NV

Most prevalent malware files from Talos telemetry over the past week

SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 **MD5:**2915b3f8b703eb744fc54c81f4a9c67f **Typical Filename:**VID001.exe **Claimed Product:**N/A Detection Name: Win.Worm.Coinminer::1201

SHA 256: e248b01e3ccde76b4d8e8077d4fcb4d0b70e5200bf4e738b45a0bd28fbc2cae6 **MD5:**1e2a99ae43d6365148d412b5dfee0e1c **Typical Filename:**PDFpower.exe **Claimed Product:**PdfPower Detection Name: Win32.Adware.Generic.SSO.TALOS

SHA 256: f3d5815e844319d78da574e2ec5cd0b9dd0712347622f1122f1cb821bb421f8f **MD5:**a2d60b5c01a305af1ac76c95e12fdf4a **Typical Filename:**KMSAuto.exe **Claimed Product:**N/A Detection Name: W32.File.MalParent

SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934 **MD5:**93fefc3e88ffb78abb36365fa5cf857c **Typical Filename:**Wextract **Claimed Product:**Internet Explorer Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg

SHA 256: 00ab15b194cc1fc8e48e849ca9717c0700ef7ce2265511276f7015d7037d8725 **MD5:**d47fa115154927113b05bd3c8a308201 **Typical Filename:**mssqlsrv.exe **Claimed Product:**N/A Detection Name: Trojan.GenericKD.65065311