Asian nation’s power grid subjected to ShadowPad malware attack

September 13, 2023

Novel threat operation RedFly has targeted an unnamed Asian country's national grid with the ShadowPad malware, also known as PoisonPlug, enabling credential theft and extensive computer compromise over a six-month period, according to The Hacker News. Initial compromise of the power grid commenced with the execution of ShadowPad in a single computer on Feb. 23, a report from the Symantec Threat Hunter Team showed. ShadowPad was then executed again on May 17, coinciding with the distribution of the Packerloader tool with arbitrary shellcode execution capabilities. Several PowerShell commands were then leveraged by RedFly to obtain storage device data and enable Windows Registry credential dumping while removing security logs before LSASS credentials were dumped before the end of May. Attackers were later discovered to perform keylogger installation and LSASS and Registry credential extraction from July 27 to Aug. 3. Infrastructure and tooling used in the new attack resembled those of Chinese state-backed threat operation APT41, also known as Winnti, said researchers.

SC Staff

North Korea hacking concept of a computer keyboard and a key painted with the North Korean flag

Threat Intelligence

Novel OtterCookie malware added to Contagious Interview attack arsenal

SC StaffDecember 27, 2024

BleepingComputer reports that intrusions with the new OtterCookie malware and its updated iteration have been launched by North Korean threat actors against software developers as part of the Contagious Interview campaign, which initially involved the deployment of the BeaverTail and InvisibleFerret payloads.

IoT

Vulnerable devices subjected to ongoing attacks with updated Mirai botnet

SC StaffDecember 26, 2024

BleepingComputer reports that intrusions involving a new Mirai-based botnet have been targeting Teltonika RUT9XX routers impacted by the CVE-2018-17532 flaw, TP-Link devices affected by CVE-2023-1389, and DigiEver DS-2105 Pro network video recorders with a yet-to-be patched remote code execution vulnerability as part of an attack campaign believed to have commenced in September.

Network Security

Novel BellaCiao malware variant launched by Charming Kitten

SC StaffDecember 26, 2024

Attacks with an updated C++ variant of the BellaCiao dropper malware dubbed "BellaCPP" have been deployed by Iranian state-backed threat operation Charming Kitten — also known as APT35, CharmingCypress, CALANQUE, Mind Sandstorm, TA453, Newscaster, and Yellow Garuda — to facilitate further payload delivery, according to The Hacker News.

Related Events

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news