The Federal Bureau of Investigation (FBI) has issued a stark warning to the public, private sector, and international partners regarding persistent cyber threats from actors affiliated with the Russian Federal Security Service’s (FSB) Center 16. This unit, recognized in cybersecurity circles under monikers such as “Berserk Bear” and “Dragonfly,” has been actively exploiting vulnerabilities in […]

The post FBI Warns Russian State Hackers Targeting Critical Infrastructure Networking Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sophisticated cyber espionage campaign attributed to APT MuddyWater has emerged targeting Chief Financial Officers and finance executives across Europe, North America, South America, Africa, and Asia.

The threat actors are deploying a multi-stage phishing operation that masquerades as legitimate recruitment communications from Rothschild & Co, leveraging Firebase-hosted phishing pages with custom CAPTCHA challenges to deceive high-value targets.

The campaign demonstrates significant evolution in the group’s tactics, incorporating legitimate remote access tools including NetBird and OpenSSH to establish persistent backdoors within corporate networks.

The attack sequence begins with carefully crafted spear-phishing emails that direct victims to Firebase-hosted domains such as googl-6c11f.firebaseapp.com, where targets encounter seemingly legitimate “human verification” challenges.

Upon completing these fabricated CAPTCHA tests, victims are redirected to secondary phishing sites that deliver malicious ZIP archives disguised as PDF documents.

These archives contain VBScript files that initiate a complex multi-stage infection process designed to deploy remote access capabilities while maintaining stealth.

Hunt.io analysts identified critical infrastructure shifts within this campaign, noting the transition from previously documented command-and-control servers at 192.3.95.152 to new infrastructure at 198.46.178.135.

The researchers discovered multiple Firebase projects utilizing identical phishing kits, including cloud-ed980.firebaseapp.com and cloud-233f9.web.app, all employing AES-encrypted redirect mechanisms with hard-coded passphrases to evade detection systems.

The malware’s persistence mechanisms represent a particularly concerning aspect of this campaign.

The initial VBS downloader (F-144822.vbs) retrieves a secondary payload from the attacker-controlled infrastructure, specifically targeting the path /34564/cis.ico, which is renamed to cis.vbs upon execution.

This second-stage script performs several critical functions, including the silent installation of NetBird and OpenSSH MSI packages using the following command structure:-

msiexec /i netbird.msi /quiet
msiexec /i OpenSSH.msi /quiet

Advanced Persistence and Remote Access Implementation

The campaign’s most sophisticated element lies in its comprehensive persistence strategy, which combines multiple legitimate tools to establish redundant access channels.

The malware creates a hidden administrative account named “user” with the password “Bs@202122”, effectively providing attackers with privileged system access that persists across system reboots.

This account is strategically hidden from Windows login screens through registry modifications, ensuring it remains undetected during routine system administration activities.

NetBird deployment utilizes a preconfigured setup key (E48E4A70-4CF4-4A77-946B-C8E50A60855A) to establish secure tunnel connections, while simultaneously enabling Remote Desktop Protocol services and configuring firewall exceptions.

The malware ensures service reliability through scheduled task creation, specifically implementing “ForceNetbirdRestart” tasks that automatically restart NetBird services after system startup delays.

Additionally, the campaign removes NetBird desktop shortcuts from all user profiles, effectively concealing the presence of newly installed remote access software from casual observation by system administrators or users.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post APT MuddyWater Attacking CFOs Leveraging OpenSSH, Enables RDP, and Scheduled Task appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a sophisticated new threat campaign that leverages a seemingly legitimate PDF editor application to transform infected devices into residential proxies.

The malicious software, distributed under the guise of productivity tools, represents an evolving approach by threat actors who are increasingly exploiting trusted software categories to establish persistent network access and monetize compromised systems.

The attack begins with files bearing the code-signing signature “GLINT SOFTWARE SDN. BHD.” which initially appears to lend credibility to the malicious payload.

However, beneath this veneer of legitimacy lies a complex infection chain that starts with JavaScript components designed to drop and execute the primary trojan, dubbed “ManualFinder.”

This multi-stage approach demonstrates the attackers’ understanding of modern security detection mechanisms and their efforts to evade traditional signature-based detection systems.

ExpelSecurity analysts identified this emerging threat through their monitoring of suspicious network activities and file behavior patterns.

The researchers observed that the malware’s initial deployment strategy relies heavily on the OneStart Browser application, which has been flagged as consistently problematic software.

This browser creates scheduled tasks that execute JavaScript files from the user’s temporary directory, establishing a foothold for the subsequent malware deployment.

The infection mechanism reveals a carefully orchestrated process where the JavaScript component reaches out to command and control domains, specifically mka3e8[.]com and similar infrastructure.

These domains serve as distribution points for the ManualFinder application, which maintains the same fraudulent code-signing certificate to maintain the appearance of legitimacy throughout the infection chain.

Deceptive Functionality and Proxy Operations

What makes this threat particularly insidious is its dual-purpose design that combines genuine functionality with malicious behavior.

When executed in a controlled sandbox environment, ManualFinder actually performs its advertised function of helping users locate product manuals and documentation.

This legitimate functionality serves as an effective smokescreen, potentially allowing the malware to bypass behavioral analysis systems that might otherwise flag purely malicious code.

However, the application’s true purpose becomes evident when analyzing its network behavior and system modifications.

The trojan transforms infected devices into residential proxy nodes, effectively creating a distributed network of compromised systems that can be monetized by the threat actors.

This proxy functionality allows attackers to route traffic through victim machines, potentially facilitating various illegal activities while obscuring the true source of malicious network traffic.

The malware’s persistence mechanism through OneStart Browser’s scheduled task creation ensures continued operation even after system reboots.

This approach highlights the attackers’ focus on maintaining long-term access to compromised systems rather than pursuing immediate, obvious malicious activities that might trigger user suspicion or security alerts.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Threat Actors Weaponize PDF Editor With New Torjan to Turn Device Into Proxy appeared first on Cyber Security News.