Download our Cyber Threat Intelligence Digest - August 2024: Week 31

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Progress Software MOVEit Vulnerability Allows Privilege Escalation - Progress Software identified a high-severity vulnerability CVE-2024-6576 in MOVEit Transfer that can lead to privilege escalation. The vulnerability affects MOVEit Transfer versions from 2023.0.0 to 2023.0.11, 2023.1.0 to 2023.1.6, and 2024.0.0 to 2024.0.2.

CVE-2024-7352 allows Remote Code Execution affecting PDF-XChange Editor – This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

CVE-2024-7234 Privilege Escalation affecting AVG - AVG Antivirus Free contains a vulnerability that has been deemed critical. This vulnerability results in privilege escalation when an unknown input is manipulated. Information on potential countermeasures is lacking. Switching out the product for an equivalent one is advised.

Potential Threats

WASP Stealer Delivered by Threat Actors Impersonating Zoom - On July 31, 2024, security researcher JAMESWT shared samples of fake Zoom installers containing the WASP stealer on MalwareBazaar. Also known as W4SP, WASP is an information stealer that primarily targets Discord accounts, passwords, cryptocurrency wallets, and other sensitive data.

Predator Spyware - On July 31, 2024, Insikt Group reported new infrastructure related to Predator spyware. Predator is sophisticated spyware that infects both Android and iPhone devices using various methods, including zero-day vulnerabilities in popular browsers and operating systems.

New BingoMod RAT Masks as Legitimate Application and Wipes Data - BingoMod, a new Android-based banking remote access trojan, is infecting mobile devices to conduct unauthorised money transfers. As reported by Security Firm Cleafy on July 31, 2024, the malware is disguised as antivirus software and is distributed through smishing.

General News

Spyware remained undetected on Google app store - A sophisticated cyber espionage tool known as Mandrake has been found in five apps that were available for download on Google Play for nearly two years, targeting users in Canada, Germany, Italy, Mexico, Spain, Peru and the U.K.

Android Malware Campaign Infects Devices in 113 Countries - On July 29, 2024, Zimperium reported an ongoing campaign distributing Android malware through Telegram bots and malicious advertisements imitating Google Play. The campaign has been targeting Android devices across 113 countries intending to steal one-time passwords (OTPs) for financial gain.

Hackers directly email customers of immigration firm after damaging cyberattack - Sable International, which has offices in the U.K., Australia and South Africa, released several statements this week about a “sophisticated” cyberattack that caused a range of issues, including emailing customers about the incident, likely to put pressure on the firm to pay a ransom.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group’s severity. These updates can be seen below.

Global Trends Powered by Recorded Future

Within each category, we have provided the current top five globally trending items. Each item is linked to how actively trending it is and is marked with a small symbol. 

The spikes in references are calculated over 60 days and are normalised to ensure they aren’t disproportionate when compared to bigger entities that will naturally have more baseline mentions.

▲- Spike – This indicates a large increase in reporting volume and a high diversity in the event descriptions,
▲- Rise – This indicates a small increase in reporting volume with little diversity in the descriptions.